CVE-2024-28833

What it actually does

The vulnerability permits an unlimited number of authentication attempts against the second factor of two-factor authentication mechanisms without rate limiting or account lockout, enabling brute-force attacks on TOTP or similar codes after a valid first factor is supplied.

Why it matters to the business

Attackers can gain unauthorized access to user accounts in Checkmk environments by guessing second-factor codes, potentially exposing monitoring data, configuration, and connected infrastructure with minimal detection.

How an attack unfolds

An attacker first obtains valid primary credentials, initiates an authentication session, then submits repeated guesses for the second-factor token in rapid succession; because excessive attempts are not restricted, the attacker can exhaustively try codes until the correct one is found and complete the login.

How to fix it

Upgrade all Checkmk 2.3 installations to version 2.3.0p6 or later, which enforces proper rate limiting on second-factor attempts; until the upgrade is complete, enforce IP-based restrictions or additional monitoring around authentication endpoints.

How to confirm the fix worked

Verify the installed Checkmk version is 2.3.0p6 or newer; after upgrade, confirm that repeated failed second-factor submissions from a single source trigger throttling or blocking within a short window.

Typical attack path

1. Obtain valid primary authentication credentials via phishing, credential stuffing, or other means
2. Initiate a login request supplying the first factor
3. Repeatedly submit guessed second-factor codes without encountering rate limits or lockouts
4. Upon successful guess, obtain a valid session and access the application

How to detect it

Search authentication and web-server logs for unusually high numbers of failed second-factor submissions originating from the same IP addresses or user accounts within short time windows; correlate with successful logins that follow such patterns.

What your security team should do

• Immediately schedule upgrade to Checkmk 2.3.0p6 across all affected instances
• Implement temporary network-level rate limiting or WAF rules on authentication paths
• Review authentication logs for high volumes of failed 2FA attempts and alert on anomalies
• Consider enforcing hardware tokens or phishing-resistant MFA where feasible