CVE-2024-38857

What it actually does

Improper input neutralization allows construction of URLs that cause the application to redirect users to arbitrary external domains without validation.

Why it matters to the business

Attackers can trick users into visiting phishing sites, increasing risk of credential theft, malware infection, and loss of user trust in the monitoring platform.

How an attack unfolds

An attacker creates a specially formed link that exploits the missing redirect validation, distributes it through email or other channels, and relies on the victim clicking it to land on an attacker-controlled phishing page.

How to fix it

Upgrade Checkmk to 2.3.0p8, 2.2.0p28, 2.1.0p45 or newer; migrate any remaining 2.0.0 installations to a supported release.

How to confirm the fix worked

Verify installed version against the fixed releases and test that crafted redirect URLs now produce an error or are blocked instead of forwarding.

Typical attack path

1. Locate a reachable Checkmk web interface
2. Craft a URL containing an unvalidated redirect target parameter
3. Deliver the link via phishing email or compromised site
4. Victim follows the link and is redirected to the attacker site

How to detect it

Inspect web access logs for Checkmk paths containing redirect parameters that point to external domains or that produce unusually high volumes of 3xx responses.

What your security team should do

• Apply the listed patches on all Checkmk instances without delay
• Review and harden any custom redirect handling in monitoring dashboards
• Include open-redirect testing in regular web-application security scans