Werk #17028: Fix Livestatus injection via REST-API

Component

REST API

Title

Fix Livestatus injection via REST-API

Date

Jan 13, 2025

Level

Trivial Change

Class

Security Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

2.5.0b1 Not yet released	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.4.0b1	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0p25	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.2.0p39	Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)

Prior to this fix, a REST API endpoint improperly handled escaping of data received through POST requests. This vulnerability allowed users with the update_and_acknowledge permission for events to inject arbitrary Livestatus commands via the affected endpoint.

Affected Versions:

2.4.0 (beta)
2.3.0
2.2.0
2.1.0 (EOL)

Vulnerability Management:

We have rated the issue with a CVSS score of 6.0 (Medium) with the following CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N, and assigned CVE-2024-38865.

To the list of all Werks