CVE-2024-28832

What it actually does

Allows users with Global Settings modification rights to store arbitrary HTML and JavaScript in the Crash Report URL field, which is rendered without sanitization on the Crash Report page, resulting in script execution in viewers' browsers.

Why it matters to the business

Compromised privileged accounts could lead to session hijacking against other administrators, exposing monitoring configurations, alert data, and infrastructure visibility across the environment.

How an attack unfolds

An attacker with Global Settings access injects a malicious payload into the Crash Report URL setting; the stored content executes when any user loads the Crash Report page, allowing actions such as cookie theft or unauthorized configuration changes.

How to fix it

Upgrade Checkmk to 2.3.0p7, 2.2.0p28, 2.1.0p45 or later. On Debian 13 systems, install package version 6.7.9-1 or newer.

How to confirm the fix worked

Confirm the running Checkmk version meets or exceeds the listed fixed releases and inspect the Crash Report URL setting to ensure input sanitization prevents HTML or script injection.

Typical attack path

1. Obtain or compromise an account permitted to change Global Settings
2. Navigate to Global Settings and locate the Crash Report URL option
3. Insert HTML or script elements containing attacker-controlled code
4. Trigger or wait for a user to view the Crash Report page
5. Execute actions in the context of the viewing user's session

How to detect it

Examine stored Global Settings for HTML or script content in the Crash Report URL field and search web server logs for requests to the Crash Report page containing unusual parameters or referrers.

• Crash Report URL containing <script
• javascript: in global settings value
• unusual HTML tags persisted in crash report configuration

What your security team should do

• Apply the specified Checkmk updates without delay
• Audit all Global Settings entries for unexpected content in the Crash Report URL field
• Restrict Global Settings permissions to the minimum necessary accounts
• Review web access logs for anomalous Crash Report page activity