PT-2021-21290 · Checkmk+1 · Checkmk+1

Edgarloyola · Published 2021-07-26 · Updated 2022-07-20 · CVE-2021-36563

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CheckMK management web console versions 1.5.0 through 2.0.0

Description The CheckMK management web console does not sanitise user input in various parameters of the WATO module, allowing an attacker to open a backdoor on the device with HTML content and interpreted by the browser, such as JavaScript or other client-side scripts. The XSS payload will be triggered when the user accesses some specific sections of the application. An attacker with the monitor role can use stored XSS to steal the secretAutomation and create another administrator user with high privileges. Persistent XSS also allows an attacker to modify the displayed content or change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session.

Recommendations For CheckMK management web console versions 1.5.0 through 2.0.0, consider disabling the WATO module until a patch is available to prevent exploitation. Restrict access to the web management interface to minimize the risk of exploitation. Avoid using the secretAutomation parameter in the affected API endpoints until the issue is resolved. As a temporary workaround, monitor user activity and session management to detect potential hijacked sessions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-36563

USN-5527-1

USN-5527-2

Affected Products

Checkmk

Ubuntu

References · 19

• 🔥 https://github.com/Edgarloyola/CVE-2021-36563 · Exploit
• https://ubuntu.com/security/CVE-2017-9781 · Vendor Advisory
• https://checkmk.com/de/werk/12762 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36563 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5527-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36563 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24565 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5527-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5527-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36563 · Security Note
• https://ubuntu.com/security/CVE-2021-40906 · Vendor Advisory
• https://checkmk.com/de/werk/13148 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36563 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5527-1 · Vendor Advisory