CVE-2024-38863
📋 TL;DR
This vulnerability exposes CSRF tokens in URL query parameters in Checkmk monitoring software, allowing attackers to steal these tokens. Attackers can then use stolen tokens to perform Cross-Site Request Forgery attacks against authenticated users. Affected are Checkmk installations running vulnerable versions.
💻 Affected Systems
- Checkmk GmbH Checkmk
📦 What is this software?
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
⚠️ Risk & Real-World Impact
Worst Case
Attackers could perform administrative actions on behalf of authenticated users, potentially compromising the entire monitoring infrastructure, modifying configurations, or accessing sensitive monitoring data.
Likely Case
Targeted phishing attacks where attackers trick authenticated users into clicking malicious links that capture CSRF tokens, then use those tokens to perform unauthorized actions within the user's session.
If Mitigated
With proper network segmentation and access controls, the impact is limited to actions within the user's current session permissions, but could still lead to unauthorized configuration changes.
🎯 Exploit Status
Exploitation requires the attacker to trick an authenticated user into clicking a malicious link or visiting a compromised site. The vulnerability is in specific request patterns that leak tokens.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.0p18, 2.2.0p35, or 2.1.0p48
Vendor Advisory: https://checkmk.com/werk/17096
Restart Required: Yes
Instructions:
1. Backup your Checkmk configuration. 2. Update to the patched version using your package manager (apt/yum). 3. Restart the Checkmk service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to Checkmk web interface to trusted networks only
Configure firewall rules to limit access to Checkmk ports (typically 80/443)
Reverse Proxy Configuration
linuxUse a reverse proxy to strip or sanitize query parameters containing CSRF tokens
Configure nginx/apache to filter or rewrite URLs containing CSRF token parameters
🧯 If You Can't Patch
- Implement strict network segmentation to limit Checkmk access to trusted users only
- Deploy web application firewall rules to detect and block requests with CSRF tokens in query parameters
🔍 How to Verify
Check if Vulnerable:
Check your Checkmk version: if it's below 2.3.0p18, 2.2.0p35, or 2.1.0p48, you are vulnerableCheck Version:
omd versionVerify Fix Applied:
After patching, verify the version is at or above the patched versions and test that CSRF tokens are no longer exposed in query parameters📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing CSRF token parameters in URLs
- Unusual administrative actions from unexpected IP addresses
Network Indicators:
- HTTP traffic containing 'csrf_token' or similar parameters in query strings
- Requests to Checkmk from unexpected sources
SIEM Query:
source="checkmk_access.log" AND url="*csrf*"