Multiple Vulnerabilities Reported in Checkmk IT Infrastructure Monitoring Software

The vulnerabilities detected could be chained together

Multiple vulnerabilities have been disclosed in Checkmk IT Infrastructure monitoring software that could be chained together by an unauthenticated, remote attacker to fully take over affected servers.

“These vulnerabilities can be chained together by an unauthenticated, remote attacker to gain code execution on the server running Checkmk version 2.1.0p10 and lower,” SonarSource researcher Stefan Schiller said in a technical analysis.

Checkmk’s open source edition of the monitoring tool is based on Nagios Core and offers integrations with NagVis for the visualization and generation of topological maps of infrastructures, servers, ports, and processes.

According to its Munich-based developer tribe29 GmbH, its Enterprise and Raw editions are used by over 2,000 customers, including Airbus, Adobe, NASA, Siemens, Vodafone, and others.

The four vulnerabilities, which consist of two Critical and two Medium severity bugs, are as follows –

A code injection flaw in watolib’s auth.php (CVSS score: 9.1)
An arbitrary file read flaw in NagVis (CVSS score: 9.1)
A command injection flaw Checkmk’s Livestatus wrapper and Python API (CVSS score: 6.8), and
A server-side request forgery (SSRF) flaw in the host registration API (CVSS score: 5.0)

While these shortcomings on their own have a limited impact, an adversary can chain the issues, starting with the SSRF flaw to access an endpoint only reachable from localhost, using it to bypass authentication and read a configuration file, ultimately gaining access to the Checkmk GUI.

Schiller said that the access could further be turned into remote code execution by exploiting a Code Injection vulnerability in a Checkmk GUI subcomponent called watolib, which generates a file named auth.php required for the NagVis integration.

Following responsible disclosure on August 22, 2022, the four vulnerabilities have been patched in Checkmk version 2.1.0p12 released on September 15, 2022.

The findings follow the discovery of multiple flaws in other monitoring solutions like Zabbix and Icinga since the start of the year, which could have been exploited to compromise the servers by running arbitrary code.