Insufficiently Protected Credentials in Checkmk REST API

Executive Summary

This vulnerability involves insufficiently protected credentials in the REST API of Checkmk software versions before 2.5.0p15, 2.4.0p37, and 2.3.0p51. An authenticated user can view sensitive information like SNMP community strings, SNMPv3 authentication and privacy passphrases, and IPMI passwords in plain text through GET API responses, even though these values are not displayed in the setup GUI.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Checkmk REST API responses for host configurations expose sensitive credentials. Use curl commands to query the API endpoints for hosts and inspect the responses for plaintext SNMP community strings, SNMPv3 passphrases, or IPMI passwords. Example: curl -u username:password http://your-checkmk-server/check_mk/api/v0/objects/host_config/your-host-name

Useful 0 Not Useful 0

Impact Analysis

An attacker with access to the API could steal stored credentials, potentially gaining unauthorized access to network devices or systems configured through Checkmk. This could lead to further compromise of infrastructure, data breaches, or lateral movement within a network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive data, such as credentials, which may result in unauthorized access to personal or health information. Organizations using affected Checkmk versions may violate data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Checkmk to a patched version (>=2.5.0p15, >=2.4.0p37, >=2.3.0p51) to redact sensitive credentials from API responses. Ensure no unauthorized users have access to the REST API. Review API logs for suspicious queries targeting host configurations.

Useful 0 Not Useful 0