CVE-2024-28827
📋 TL;DR
This vulnerability allows a local attacker to escalate privileges to SYSTEM level on Windows systems running vulnerable Checkmk Windows Agent versions. The issue stems from incorrect permissions on the agent's data directory, enabling unauthorized access. Organizations using Checkmk monitoring on Windows endpoints with affected agent versions are at risk.
💻 Affected Systems
- Checkmk Windows Agent
📦 What is this software?
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM privilege compromise allowing complete control over the Windows system, installation of persistent malware, credential theft, and lateral movement across the network.
Likely Case
Local privilege escalation leading to unauthorized administrative access, data exfiltration, and potential ransomware deployment on affected systems.
If Mitigated
Limited impact with proper access controls, monitoring, and network segmentation preventing lateral movement even if local escalation occurs.
🎯 Exploit Status
Requires local access to the Windows system but exploitation is straightforward once local access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Checkmk 2.3.0p8, 2.2.0p29, 2.1.0p45, or later
Vendor Advisory: https://checkmk.com/werk/16845
Restart Required: Yes
Instructions:
1. Identify affected Checkmk Windows Agent installations. 2. Upgrade to patched versions: 2.3.0p8+, 2.2.0p29+, or 2.1.0p45+. 3. Restart the Checkmk Agent service on Windows systems.
🔧 Temporary Workarounds
Restrict data directory permissions
windowsManually set proper permissions on the Checkmk Agent data directory to prevent unauthorized access
icacls "C:\ProgramData\checkmk\agent\data" /inheritance:r /grant "SYSTEM:(OI)(CI)F" /grant "Administrators:(OI)(CI)F" /grant "LOCAL SERVICE:(OI)(CI)RX"
🧯 If You Can't Patch
- Implement strict access controls and monitoring on Windows systems with vulnerable agents
- Segment network to limit lateral movement from potentially compromised systems
🔍 How to Verify
Check if Vulnerable:
Check Checkmk Agent version on Windows systems: Open Services, find Checkmk Agent service, check properties for version information.Check Version:
sc query "Checkmk Agent" | findstr /i "display_name" or check service properties in Windows ServicesVerify Fix Applied:
Verify version is 2.3.0p8+, 2.2.0p29+, or 2.1.0p45+ and check data directory permissions are properly restricted.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing privilege escalation attempts
- Checkmk Agent logs showing unauthorized access to data directory
- Security logs with unexpected SYSTEM privilege usage
Network Indicators:
- Unusual outbound connections from Windows systems running Checkmk Agent
- Lateral movement attempts from previously low-privilege systems
SIEM Query:
EventID=4672 OR EventID=4688 AND ProcessName contains 'checkmk' AND NewTokenElevationType=2