CVE-2023-22318

What it actually does

Remote unauthenticated attacker can trigger a denial of service condition in the Webconf component, resulting in high availability impact with no effect on confidentiality or integrity.

Why it matters to the business

Temporary or prolonged unavailability of the web configuration interface disrupts operational workflows and monitoring capabilities until the service is restarted or the system is updated.

How an attack unfolds

An attacker locates an exposed web interface and sends crafted network requests that exploit the flaw in Webconf, causing the service to crash or become unresponsive.

How to fix it

Upgrade the Checkmk Appliance to version 1.6.5 or newer. Where chromium packages are present, update to version 115.0.5790.98-1~deb11u1.

How to confirm the fix worked

Verify the installed version is at least 1.6.5 for the appliance or 115.0.5790.98-1~deb11u1 for chromium packages and confirm the webconf service remains responsive under load testing.

Typical attack path

1. Locate publicly reachable Checkmk Appliance web interface
2. Craft and transmit malicious requests targeting the Webconf endpoint
3. Confirm service becomes unavailable to legitimate users

How to detect it

Review web server and appliance logs for repeated malformed requests to webconf endpoints followed by service crashes or restarts; correlate with availability alerts.

What your security team should do

• Apply the listed fixed versions immediately due to public disclosure
• Restrict network access to the web interface until patches are deployed
• Monitor for service restarts or crashes in appliance logs