back to website

Werk #16434: Synthetic Monitoring: Privilege Escalation

Component Agent bakery
Title Synthetic Monitoring: Privilege Escalation
Date Jun 24, 2024
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed
Checkmk versions & editions
2.4.0b1
Not yet released 		Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0p8 Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)

The Robotmk scheduler was affected by a privilege escalation issue. This issue affects users, which have configured the rule Robotmk scheduler (Windows). Specifically, an attacker is able to exploit the issue, if

  1. Automated environment setup (via RCC) was configured in the Robotmk scheduler (Windows) rule,
  2. the same plan was configured without configuring Execute plan as a specific user
  3. and a user on the host, onto which the scheduler has been deployed, was compromised.

In this event, the attacker could gain SYSTEM privileges on the host. If Execute plan as a specific user is configured, then the attacker could compromise that specific user, rather than SYSTEM.

There is a second similar, but distinct issue. If

  • there are two or more plans configured with Execute plan as a specific user with distinct users
  • and one of the configured users was already compromised.

The attacker could then compromise the other user.

Background:

The Robotmk scheduler is started by the Checkmk agent that runs with SYSTEM privileges. Moreover, Robotmk allows the user to automatically build Python environments via RCC. During setup the scheduler would enable a RCC feature called shared holotree usage. This feature allows all users on the host to edit these Python environments. Thus, any compromised user on the host is also able to compromise a user, which executes code from these shared environments.

With this Werk, shared holotree usage will no longer be enabled. Affected users will have their access to the vulnerable Python environments revoked. Moreover, the permissions inside of the working directory of Robotmk have been reworked. Users now only have access to directories, which are required for their own executions.

Note, you must update both Checkmk and redeploy the latest Robotmk Scheduler.

Affected Versions:

  • 2.3.0

Mitigations:

If updating is not possible:

  • Do not use the rule Automated environment setup (via RCC).
  • Always use the same user for Execute plan as a specific user.

Vulnerability Management:

We have rated the issue with a CVSS Score of 7.8 (High) with the following CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CVE-2024-39934 has been assigned to this issue.

To the list of all Werks