CVE-2024-28828

What it actually does

The vulnerability is a cross-site request forgery flaw that allows an attacker to submit authenticated HTTP requests on behalf of a logged-in user to perform arbitrary administrative actions without additional confirmation.

Why it matters to the business

Successful exploitation can result in complete takeover of the monitoring site, enabling attackers to disrupt operations, exfiltrate sensitive infrastructure data, or pivot to other systems, with elevated urgency due to the high impact and broad affected version range across many deployments.

How an attack unfolds

An attacker prepares a malicious webpage containing forged requests targeting Checkmk administrative endpoints; when an authenticated user visits the page, their browser automatically sends the requests using existing session credentials, allowing the attacker to compromise the site in a single click.

How to fix it

Upgrade all instances to Checkmk 2.3.0p8 or newer, 2.2.0p29 or newer, or 2.1.0p45 or newer; migrate any remaining 2.0.0p39 or older EOL installations to a supported release. Enable additional web application firewall rules or referer checks as a temporary layer until patches are applied.

How to confirm the fix worked

Confirm the running Checkmk version meets or exceeds the fixed releases listed in the advisory; review changelog entries for added CSRF token protections and test by attempting to replay administrative actions from an external origin.

Typical attack path

1. Identify an authenticated Checkmk user and craft a malicious webpage or link embedding forged requests
2. Deliver the link via phishing email, compromised site, or other social engineering
3. Victim's browser submits the requests to the Checkmk instance using valid session cookies
4. Attacker executes privileged actions such as account creation or configuration changes to achieve full site compromise

How to detect it

Examine web server access logs for POST or state-changing requests to administrative endpoints that originate from unexpected external referrers or lack proper CSRF tokens; correlate with audit logs showing configuration or user changes lacking corresponding legitimate activity.

What your security team should do

• Immediately schedule upgrades for all Checkmk deployments to the patched versions
• Audit recent administrative changes for unauthorized modifications
• Implement network segmentation and least-privilege access for monitoring consoles
• Educate users on avoiding untrusted links while authenticated to administrative interfaces