CVE-2024-6163

What it actually does

Certain unauthenticated HTTP endpoints in Checkmk allow remote attackers to bypass authentication checks and retrieve sensitive data.

Why it matters to the business

Attackers can access monitoring configuration and performance data without credentials, increasing risk of information disclosure in environments running older releases.

How an attack unfolds

An attacker identifies exposed Checkmk instances and directly requests specific HTTP endpoints that lack proper authentication enforcement, retrieving data that should require login.

How to fix it

Upgrade Checkmk to version 2.3.0p10 or newer, 2.2.0p31 or newer, 2.1.0p46 or newer, or apply the fix for 2.0.0p39 and later; disable or restrict access to the affected endpoints until patches are applied.

How to confirm the fix worked

Verify the installed Checkmk version against the fixed releases, review endpoint access controls in configuration, and test that unauthenticated requests to the previously vulnerable paths now return authentication errors.

Typical attack path

1. Scan for publicly reachable Checkmk web interfaces
2. Craft HTTP requests targeting the vulnerable endpoints
3. Bypass authentication controls to retrieve restricted data
4. Analyze obtained information for further reconnaissance or lateral movement

How to detect it

Inspect web server and application logs for requests to the affected endpoints that lack session or authentication tokens; correlate with source IP addresses showing repeated access attempts without prior login activity.

What your security team should do

• Prioritize patching internet-facing Checkmk instances first due to remote unauthenticated nature
• Review network exposure of Checkmk web interfaces and apply least-privilege access controls
• Monitor for unusual unauthenticated requests to monitoring endpoints in web server logs