back to website

Werk #17009: XSS in inventory tree

Component HW/SW inventory
Title XSS in inventory tree
Date Jun 7, 2024
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed
Checkmk versions & editions
2.4.0b1
Not yet released 		Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0p7 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.2.0p28 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.1.0p45 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

Prior to this Werk an attacker with control over an agent was able to inject HTML in the output which was then rendered in the inventory tree of the coresponding host.

This problem exists only if the rule Do hardware/software inventory is set for the compromised agent/host.

We found this vulnerability internally.

Affected Versions:

  • 2.3.0
  • 2.2.0
  • 2.1.0
  • 2.0.0

Mitigations: If you are unable to patch you can disable inventory scanning for all hosts.

Indicators of Compromise: You can check var/check_mk/inventory/ for inventories with embedded HTML. This only indicates current 'attacks'. Previous attacks (where the agent does not output the payload anymore) are not discoverable after some time (caching).

Vulnerability Management: We have rated the issue with a CVSS Score of 6.5 (Medium) with the following CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L We assigned CVE-2024-5741 to this vulnerability.

Changes: This Werk adds sanitation to the HTML output.

To the list of all Werks