CVE-2024-38859

What it actually does

Cross-site scripting flaw allowing injection of arbitrary HTML and script content into the SLA column title of a monitoring view; the payload persists in the view definition and executes in the browser context of any user who clones the affected view.

Why it matters to the business

Attackers can run unauthorized code inside other users' monitoring sessions, risking theft of credentials, session tokens, or sensitive operational data displayed in dashboards; delayed patching leaves shared monitoring environments exposed to lateral movement or phishing.

How an attack unfolds

An authenticated low-privileged user creates or edits a view containing an SLA column, places malicious HTML and script in the column title, then waits for another user to clone the view; the script executes with the cloning user's permissions when the cloned view renders.

How to fix it

Upgrade Checkmk to version 2.3.0p14, 2.2.0p33, 2.1.0p47 or later; disable or remove untrusted custom views and SLA columns until patches are applied; enforce least-privilege access for view creation and cloning.

How to confirm the fix worked

Verify installed package version against the fixed releases listed above; review existing views for unexpected HTML or script content in SLA column titles; attempt a controlled clone operation after upgrade to confirm the payload no longer executes.

Typical attack path

1. Obtain low-privileged authenticated access to Checkmk
2. Create or modify a view and configure an SLA column with a malicious title containing script tags
3. Share or make the view available for cloning
4. Victim user clones the view and triggers execution of the injected script
5. Script performs actions such as credential harvesting or data exfiltration within the monitoring interface

How to detect it

Search application and web-server logs for view creation or clone events containing HTML tags or script elements in column titles; inspect persisted view configurations for suspicious content in SLA-related fields; correlate clone operations with subsequent unexpected script execution or outbound requests.

What your security team should do

• Immediately schedule upgrades to the patched releases for all instances
• Audit existing custom views and SLA columns for suspicious content
• Restrict view creation and cloning privileges to trusted administrators
• Monitor user activity logs for unusual view cloning events
• Add the vulnerability to the organization's patch management backlog with high priority