CVE-2024-28832
📋 TL;DR
This vulnerability allows authenticated users with Global Settings permissions to inject malicious HTML/JavaScript into the Crash Report URL field, creating stored cross-site scripting (XSS) attacks. When other users view the affected Crash Report page, their browsers execute the injected scripts. Only Checkmk installations with users who have Global Settings modification privileges are affected.
💻 Affected Systems
- Checkmk
📦 What is this software?
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
⚠️ Risk & Real-World Impact
Worst Case
An attacker with Global Settings permissions could steal administrator session cookies, perform actions as administrators, redirect users to malicious sites, or deploy additional malware within the Checkmk environment.
Likely Case
Privilege escalation where a lower-privileged user with Global Settings access steals administrator credentials or performs unauthorized actions within the monitoring system.
If Mitigated
Limited to users who already have Global Settings permissions, with minimal impact if proper access controls and input validation are in place.
🎯 Exploit Status
Exploitation requires authenticated access with Global Settings permissions. The attack involves injecting HTML/JavaScript into a configuration field that gets rendered without proper sanitization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.0p7, 2.2.0p28, or 2.1.0p45
Vendor Advisory: https://checkmk.com/werk/17024
Restart Required: Yes
Instructions:
1. Backup your Checkmk configuration. 2. Update to the patched version for your release line. 3. Restart Checkmk services. 4. Verify the fix by checking the version and testing the Crash Report URL field.
🔧 Temporary Workarounds
Restrict Global Settings Permissions
allLimit Global Settings modification permissions to only essential administrators to reduce attack surface.
Input Validation via WAF
allDeploy web application firewall rules to block HTML/JavaScript injection attempts in configuration fields.
🧯 If You Can't Patch
- Review and restrict Global Settings permissions to minimal necessary users
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check your Checkmk version. If it's earlier than the patched versions listed above, you are vulnerable if you have users with Global Settings permissions.Check Version:
omd versionVerify Fix Applied:
After patching, verify the version is at least 2.3.0p7, 2.2.0p28, or 2.1.0p45. Test by attempting to inject HTML into the Crash Report URL field - it should be sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to Global Settings, particularly Crash Report URL field containing script tags or JavaScript
Network Indicators:
- Unexpected outbound connections from Checkmk server to external domains following configuration changes
SIEM Query:
source="checkmk" AND (event="config_change" AND field="crash_report_url" AND value CONTAINS "<script>" OR "javascript:")