PT-2023-15524 · Checkmk · Checkmk

Stefan Schiller · Published 2023-02-20 · Updated 2024-07-23 · CVE-2022-47909

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Checkmk versions 1.6.0 through 2.1.0p11 Checkmk versions 2.0.0 through 2.0.0p28

Description The issue allows an attacker to perform direct queries to the application's core from localhost by injecting Livestatus Query Language (LQL) in the AuthUser HTTP query header.

Recommendations For Checkmk versions 1.6.0 through 2.1.0p11, update to a version later than 2.1.0p11. For Checkmk versions 2.0.0 through 2.0.0p28, update to a version later than 2.0.0p28. As a temporary workaround, consider restricting access to the AuthUser HTTP query header until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-47909

Affected Products

Checkmk

References · 8

• 🔥 https://sonarsource.com/blog/checkmk-rce-chain-1 · Exploit
• https://cve.org/CVERecord?id=CVE-2022-47909 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47909 · Security Note
• https://ubuntu.com/security/CVE-2022-47909 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-47909 · Vendor Advisory
• https://checkmk.com/werk/14384 · Vendor Advisory
• https://t.me/cibsecurity/58532 · Telegram Post