Werk #17056: Don't show automation secret in the audit log (addresses CVE-2024-28830)

By default only admin users are able to see the audit log. Guests and normal monitoring users do not have acces to the audit log.

Werk #13330 already fixed a problem where passwords were shown in the audit log. This werk now addresses the problem, that still automation secrets of automation user were logged in clear text to the audit log, e.g. on change of the automation secret via REST-API or the user interface.

Existing automation secrets in the audit log should be removed automatically during the update but please double check that no automation secrets remain in the log (see next paragraph for details).

A backup of the original audit log (before automation secrets were removed) is copied to "~/var/check_mk/wato/log/sanitize_backup". If anything goes wrong during the update, you have to copy the files back to ~var/check_mk/wato/log and remove the automation secrets manually. If the update works as expected, you can remove the backup files.

In distributed setups which do not replicate the configuration, automation secrets are replaced during the update of each site.

In setups which replicate the configuration from central to remote sites no automation secrets should be present in the logs of the remote site, since only information about the activation is logged. Only if you switched to a replicated setup after the upgrade to the 2.0, automation secrets can be present in the logs. Since automation secrets may be in this scenario as well, the steps described before also apply.

Affected Versions:

• 2.3.0
• 2.2.0
• 2.1.0
• 2.0.0 (EOL)

Mitigations:

Remove automation secrets manually within the files located in ~var/check_mk/wato/log.

Vulnerability Management:

We have rated the issue with a CVSS Score of <2.7 (Low)> with the following CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N and assigned CVE CVE-2024-28830.

Zur Liste aller Werks