CVE-2023-6735
📋 TL;DR
This vulnerability allows local users on systems running vulnerable Checkmk versions to escalate their privileges to root/admin level. It affects Checkmk installations where the mk_tsm agent plugin is present. Attackers with local access can exploit this to gain full system control.
💻 Affected Systems
- Checkmk
📦 What is this software?
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Tribe29
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root privileges, enabling complete system compromise, data theft, persistence establishment, and lateral movement to other systems.
Likely Case
Malicious insider or compromised low-privilege account escalates to root, installs backdoors, steals sensitive monitoring data, and disrupts monitoring operations.
If Mitigated
With proper access controls and monitoring, impact limited to isolated system with quick detection and containment.
🎯 Exploit Status
Requires local user access but exploit is likely simple based on CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.0p18, 2.1.0p38, or 2.0.0p39
Vendor Advisory: https://checkmk.com/werk/16273
Restart Required: Yes
Instructions:
1. Backup your Checkmk configuration. 2. Update to patched version via 'omd update' or package manager. 3. Restart Checkmk services. 4. Verify update with 'omd version'.
🔧 Temporary Workarounds
Disable mk_tsm plugin
linuxTemporarily disable the vulnerable plugin until patching
omd config set AGENT_RECEIVER off
systemctl restart check-mk-agent
Restrict local user access
linuxLimit local user accounts on Checkmk servers
review /etc/passwd for unnecessary accounts
implement sudo restrictions
🧯 If You Can't Patch
- Implement strict access controls to limit local user accounts on Checkmk servers
- Monitor for privilege escalation attempts and unusual root activity
🔍 How to Verify
Check if Vulnerable:
Check Checkmk version with 'omd version' and compare against vulnerable versions (before 2.2.0p18, 2.1.0p38, 2.0.0p39)Check Version:
omd versionVerify Fix Applied:
Confirm version is 2.2.0p18, 2.1.0p38, or 2.0.0p39 or later with 'omd version'📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation in system logs
- Unusual mk_tsm plugin activity
- Sudden root access from non-admin accounts
Network Indicators:
- Unusual outbound connections from Checkmk server post-exploit
SIEM Query:
source="checkmk.log" AND ("privilege escalation" OR "root access" OR "mk_tsm")