CVE-2024-5741

What it actually does

Stored cross-site scripting flaw allows injection of script payloads into inventory tree data that are later rendered without sanitization in users' browsers.

Why it matters to the business

Attackers who can add or modify monitored inventory items may hijack administrator sessions, perform unauthorized actions, or steal data within the monitoring application, increasing risk of broader network compromise.

How an attack unfolds

An attacker with low-privileged access crafts malicious inventory data containing a script payload. The payload is stored by the application and executed automatically when any user with sufficient rights views the inventory tree view, enabling session theft or further actions.

How to fix it

Upgrade Checkmk to version 2.3.0p7 or later, 2.2.0p28 or later, or 2.1.0p45 or later. Disable or restrict inventory tree features for untrusted users until patches are applied.

How to confirm the fix worked

Verify installed version against the fixed releases listed in remediation guidance; review inventory rendering code for proper output encoding; attempt controlled XSS test payloads in a non-production instance.

Typical attack path

1. Obtain low-privileged account in the monitoring application
2. Inject or modify inventory data to include a malicious script payload
3. Wait for or lure a privileged user to view the affected inventory tree
4. Script executes in the victim's browser to exfiltrate tokens or perform actions

How to detect it

Inspect application logs and inventory data stores for entries containing script tags, event handlers, or encoded JavaScript; review web server access logs for requests that include suspicious payloads in inventory-related parameters; check browser console or proxy captures for unexpected script execution during tree rendering.

What your security team should do

• Apply the listed Checkmk updates immediately on all instances
• Review and restrict which accounts can contribute inventory data
• Monitor application logs for unexpected script execution or unusual inventory entries
• Implement web application firewall rules to block common XSS patterns targeting inventory endpoints