Arbitrary Command Execution in Checkmk's RestAPI due to Improper Sanitization

CVE-2024-38865

Summary

The Checkmk RestAPI is susceptible to a security vulnerability that allows unauthorized execution of arbitrary livestatus commands due to improper neutralization of command delimiters. This flaw exists in specific endpoints and can be exploited if the attacker has a user account assigned to a contact group, and the malicious event originates from a host within the same contact group, or from an event generated with an unknown host. Successful exploitation could lead to unauthorized manipulation and execution of commands, potentially compromising the integrity of the system.

References