CVE-2024-28826

What it actually does

Improper path restriction in check_sftp permits configured checks to perform arbitrary local file reads and writes on the Checkmk server via traversal sequences.

Why it matters to the business

Attackers can exfiltrate sensitive configuration or credential files and plant malicious content, enabling data breaches, configuration tampering, or escalation to full server compromise; prevalence across many monitoring deployments increases organizational exposure.

How an attack unfolds

An attacker with check-configuration rights crafts an SFTP check using path-traversal sequences to escape intended directories; when the check runs it reads or writes arbitrary files on the site server.

How to fix it

Upgrade Checkmk to 2.3.0p4 or newer, 2.2.0p27 or newer, or 2.1.0p44 or newer; migrate any 2.0.0 installations (EOL) to a supported release.

How to confirm the fix worked

Confirm running version matches or exceeds a listed fixed release; attempt to save an SFTP check containing traversal sequences and verify the configuration is rejected or sanitized.

Typical attack path

1. Obtain permissions to create or edit monitoring checks
2. Configure a check_sftp instance containing traversal payloads such as ../ sequences
3. Trigger execution of the check via normal monitoring cycle
4. Read sensitive files or write attacker-controlled content to achieve persistence or lateral movement

How to detect it

Search Checkmk configuration and log files for check_sftp entries containing .. or other traversal patterns; review audit logs for unexpected file reads or writes initiated by the check process.

• check_sftp
• ../
• ..\
• path traversal sequences in check configuration files

What your security team should do

• Apply the listed upgrades immediately to eliminate the path-traversal vector
• Audit all existing SFTP check definitions for suspicious path parameters
• Restrict check-configuration privileges to the smallest necessary user set