CVE-2022-46302
📋 TL;DR
This vulnerability allows authenticated Checkmk users to directly interact with the underlying Apache installation through reverse proxy configurations, enabling remote code execution with root privileges. It affects Checkmk versions 2.1.0p6 and earlier, 2.0.0p27 and earlier, and all versions of Checkmk 1.6.0 (which is end-of-life).
💻 Affected Systems
- Checkmk
📦 What is this software?
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root-level remote code execution, allowing complete control over the host, data exfiltration, and lateral movement.
Likely Case
Authenticated attackers gaining root shell access to the underlying operating system, enabling privilege escalation and persistence.
If Mitigated
Limited to authenticated user access with proper network segmentation and monitoring in place.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is in the reverse proxy configuration handling.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Checkmk 2.1.0p7, Checkmk 2.0.0p28
Vendor Advisory: https://checkmk.com/werk/14281
Restart Required: Yes
Instructions:
1. Backup your Checkmk configuration. 2. Update to Checkmk 2.1.0p7 or 2.0.0p28 using your distribution's package manager. 3. Restart Checkmk services: 'omd restart' or 'systemctl restart checkmk'. 4. Verify the update with 'omd version'.
🔧 Temporary Workarounds
Restrict reverse proxy configuration access
linuxLimit which users can modify reverse proxy configurations through Checkmk's access control settings.
# Configure in Checkmk web interface under Setup > Users > Edit user permissions
Network segmentation
linuxIsolate Checkmk servers from critical infrastructure and implement strict firewall rules.
# Example iptables rule: iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
# iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Immediately restrict Checkmk access to only trusted, necessary users and implement strict authentication controls.
- Implement network segmentation to isolate Checkmk servers and monitor for suspicious Apache configuration changes.
🔍 How to Verify
Check if Vulnerable:
Check your Checkmk version with 'omd version' or in the web interface under Help > About. If version is <=2.1.0p6, <=2.0.0p27, or any 1.6.0 version, you are vulnerable.Check Version:
omd versionVerify Fix Applied:
After updating, verify version is 2.1.0p7 or higher, or 2.0.0p28 or higher. Test that authenticated users cannot modify Apache configurations through the reverse proxy interface.📡 Detection & Monitoring
Log Indicators:
- Unusual Apache configuration changes in /omd/sites/[site]/etc/apache/conf.d/
- Suspicious commands executed as root from Checkmk processes
- Unexpected reverse proxy rule modifications
Network Indicators:
- Unusual outbound connections from Checkmk server to external systems
- SSH or other remote access attempts originating from Checkmk server
SIEM Query:
source="apache" OR source="checkmk" AND (event="configuration_change" OR event="reverse_proxy_modification")