CVE-2024-47094

What it actually does

The vulnerability inserts remote site secrets into web log files that are readable by local site users in affected Checkmk versions.

Why it matters to the business

Local users may obtain secrets that grant access to remote monitoring sites, increasing the risk of unauthorized visibility or control over distributed monitoring environments.

How an attack unfolds

An attacker with local site user access locates the web log files, extracts the inadvertently logged remote site secrets, and uses those credentials to authenticate to remote Checkmk sites.

How to fix it

Upgrade Checkmk to version 2.3.0p22 or later, 2.2.0p37 or later, or 2.1.0p50 or later to prevent secrets from being written to logs.

How to confirm the fix worked

Confirm the installed version meets or exceeds the fixed releases, then inspect web logs to verify no remote site secrets are present.

Typical attack path

1. Obtain local site user access on a Checkmk instance
2. Access web log files containing sensitive entries
3. Extract remote site secrets from the logs
4. Authenticate to remote sites using the stolen secrets

How to detect it

Examine web log files for entries that include remote site authentication details or unexpected secret strings; correlate with local user access timestamps.

• web.log entries containing remote site secrets
• log lines matching remote site credential patterns

What your security team should do

• Apply the listed version upgrades across all affected instances without delay
• Rotate any remote site secrets that may have been exposed in logs
• Review and restrict permissions on web log files