CVE-2024-38858

What it actually does

Improper input neutralization allows injection of arbitrary JavaScript that executes in the browser when users view Robotmk logs.

Why it matters to the business

Attackers can hijack administrator sessions, steal credentials, or perform actions on behalf of logged-in users who view the affected logs view, increasing risk of unauthorized access to monitoring data and infrastructure.

How an attack unfolds

An attacker supplies crafted input that reaches the Robotmk logs view without sanitization; when a privileged user opens the logs page the injected script runs in their browser context, enabling theft of session tokens or further actions.

How to fix it

Upgrade Checkmk to a build containing commit 779a2941a075e1461b45407f715176524414b994 or later release (2.3.0p14 or newer) to enforce proper input neutralization in the Robotmk logs view.

How to confirm the fix worked

Confirm the installed Checkmk version includes commit 779a2941a075e1461b45407f715176524414b994 or is at least 2.3.0p14; test by submitting known XSS payloads to inputs that populate Robotmk logs and verify they are neutralized in the rendered view.

Typical attack path

1. Identify or trigger input paths that feed into Robotmk logs
2. Inject malicious script payload via the unsanitized input
3. Lure or wait for an administrator to view the Robotmk logs view
4. Script executes in victim browser to exfiltrate tokens or perform actions

How to detect it

Inspect web server and application logs for requests to the Robotmk logs endpoint containing script tags or event handlers; review Robotmk log files for entries with HTML or JavaScript fragments; correlate unusual access to the logs view with subsequent suspicious browser activity or API calls.

• /robotmk/logs
• script src=
• onerror=
• onload=

What your security team should do

• Apply the fixed commit or upgrade to 2.3.0p14 or newer immediately
• Review and restrict access to the Robotmk logs view until patched
• Monitor for unusual script execution or session anomalies in browser consoles of monitoring users
• Add the vulnerability to the internal patching backlog with high priority due to direct administrator exposure