CVE-2024-3367

What it actually does

The vulnerability permits a local attacker to supply a single injected argument to the runmqsc command invoked by the websphere_mq agent plugin, altering command execution without requiring elevated privileges.

Why it matters to the business

Attackers with local access can modify IBM MQ configurations or execute unintended commands, risking integrity of queue manager settings and undermining trust in the monitoring platform across deployments.

How an attack unfolds

A local user on a host running the vulnerable Checkmk agent crafts configuration or input data that reaches the websphere_mq plugin; when the plugin executes runmqsc, the injected argument is processed, allowing the attacker to influence MQSC command behavior.

How to fix it

Upgrade Checkmk installations to version 2.2.0p26 or 2.3.0b5 (or later) to correct the argument handling in the websphere_mq plugin. Until patches can be applied, restrict local access to agent hosts and disable the websphere_mq plugin where feasible.

How to confirm the fix worked

Confirm the running Checkmk version meets or exceeds 2.2.0p26 or 2.3.0b5, then test the websphere_mq plugin with crafted inputs containing additional arguments to verify that only the intended runmqsc invocation occurs.

Typical attack path

1. Obtain local shell or file-write access on a system executing the Checkmk agent
2. Place or modify input that reaches the websphere_mq plugin
3. Trigger agent plugin execution (scheduled or manual)
4. Observe or leverage the resulting altered runmqsc behavior

How to detect it

Review Checkmk agent logs and websphere_mq plugin output for unexpected arguments or error messages related to runmqsc; correlate with local user activity on monitored hosts.

• runmqsc.*-
• websphere_mq.*argument
• unexpected argument to runmqsc

What your security team should do

• Apply the fixed Checkmk versions 2.2.0p26 or 2.3.0b5 without delay
• Limit local user accounts and file permissions on systems hosting Checkmk agents
• Disable or remove the websphere_mq plugin if IBM MQ monitoring is not required