CVE-2025-1075
📋 TL;DR
This vulnerability in Checkmk monitoring software causes LDAP authentication credentials to be written to Apache error log files. Administrators with access to these log files can potentially read sensitive LDAP credentials. Affected are Checkmk installations running vulnerable versions that use LDAP authentication.
💻 Affected Systems
- Checkmk GmbH Checkmk
📦 What is this software?
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
⚠️ Risk & Real-World Impact
Worst Case
Administrators or attackers with log file access obtain LDAP credentials, potentially leading to domain compromise through credential reuse or privilege escalation.
Likely Case
Administrators inadvertently expose LDAP credentials through log file access, leading to credential leakage within the organization.
If Mitigated
With proper log file permissions and access controls, only authorized administrators can access logs, limiting exposure to trusted personnel.
🎯 Exploit Status
Exploitation requires access to Apache error log files, typically requiring administrative privileges or compromised administrative accounts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.0p27, 2.2.0p40, or later versions
Vendor Advisory: https://checkmk.com/werk/17495
Restart Required: No
Instructions:
1. Backup your Checkmk configuration. 2. Update to Checkmk version 2.3.0p27 or 2.2.0p40 or later. 3. Verify the update completed successfully. 4. Check Apache error logs to confirm no further credential leakage.
🔧 Temporary Workarounds
Restrict Apache Error Log Access
allLimit access to Apache error log files to only essential administrators
chmod 640 /var/log/apache2/error.log
chown root:adm /var/log/apache2/error.log
Disable LDAP Authentication
allTemporarily disable LDAP authentication until patching is complete
omd config set LDAP_AUTH off
omd restart apache
🧯 If You Can't Patch
- Implement strict access controls on Apache log directories and files
- Regularly monitor and sanitize Apache error logs for credential leakage
🔍 How to Verify
Check if Vulnerable:
Check Checkmk version with 'omd version' and verify it's below 2.3.0p27, 2.2.0p40, or 2.1.0p51Check Version:
omd versionVerify Fix Applied:
After updating, grep Apache error logs for LDAP credential patterns: 'grep -i ldap /var/log/apache2/error.log' should show no credentials📡 Detection & Monitoring
Log Indicators:
- LDAP credentials appearing in Apache error logs
- Failed LDAP authentication attempts with credential logging
Network Indicators:
- Unusual LDAP query patterns from Checkmk servers
SIEM Query:
source="apache_error.log" AND "LDAP" AND ("password" OR "credential" OR "binddn")