CVE-2024-6052

What it actually does

The flaw permits authenticated users to persistently inject arbitrary HTML and JavaScript into stored application data that is later rendered without proper sanitization in other users' browsers, enabling cross-site scripting.

Why it matters to the business

Successful exploitation can lead to session hijacking, unauthorized configuration changes, or credential theft within the monitoring platform, potentially exposing infrastructure visibility and operational control to attackers.

How an attack unfolds

An attacker logs in with limited privileges, locates input fields that accept and persist HTML content, inserts a malicious script payload, and waits for privileged users to load the affected view, causing the script to execute in their browser context.

How to fix it

Upgrade Checkmk installations to version 2.3.0p10 or later, 2.2.0p29 or later, or 2.1.0p45 or later. Version 2.0.0 is end-of-life and requires migration to a supported release.

How to confirm the fix worked

Confirm the running Checkmk version meets or exceeds the listed fixed releases. Validate input sanitization by attempting to store and render test HTML markup and verifying it is escaped or blocked.

Typical attack path

1. Obtain a low-privileged authenticated account in Checkmk
2. Locate persistent input fields that store and render user-supplied content
3. Submit a payload containing malicious HTML or JavaScript
4. Trigger display of the stored content to higher-privileged users
5. Execute actions or harvest data via the victim's authenticated session

How to detect it

Review web access logs and application audit trails for requests containing script, img, or other HTML tags in fields expected to hold plain text. Inspect stored configuration or dashboard data for unexpected markup.

What your security team should do

• Apply the specified version upgrades immediately on all affected instances
• Audit existing stored content for unexpected HTML or script elements
• Enforce least-privilege access and review user roles within Checkmk
• Implement web application firewall rules to block common XSS patterns targeting the platform