CVE-2024-2380

What it actually does

Stored cross-site scripting vulnerability in graph rendering component allows persistent injection of malicious scripts that execute in users' browsers upon viewing rendered graphs.

Why it matters to the business

Attackers can hijack monitoring dashboards to steal session tokens or sensitive operational data, leading to unauthorized access and potential disruption of infrastructure visibility without requiring high privileges.

How an attack unfolds

An authenticated low-privileged user supplies crafted input containing script payloads through graph data sources; the payload is stored server-side and executes when higher-privileged users view the affected graphs in their browsers.

How to fix it

Upgrade Checkmk to version 2.3.0b4 or later. If immediate upgrade is not possible, restrict graph data input sources and sanitize user-supplied content used in rendering.

How to confirm the fix worked

Confirm the installed version is at least 2.3.0b4; test by attempting to inject and render a benign script payload in a graph and verify it no longer executes.

Typical attack path

1. Obtain low-privileged access to the monitoring interface
2. Inject script payload via graph configuration or data input fields
3. Wait for administrative or other users to render and view the graph
4. Execute arbitrary client-side actions such as cookie theft or unauthorized API calls

How to detect it

Inspect web server and application logs for unexpected script tags or event handlers in graph-related requests or stored configurations; review user activity for anomalous graph creations followed by admin views.

What your security team should do

• Prioritize upgrade of all Checkmk instances to the fixed release within standard change windows
• Review and restrict which users can create or modify graph data sources
• Enable web application firewall rules that block common XSS patterns in monitoring traffic
• Monitor for unusual script execution or session anomalies in dashboard access logs