CVE-2024-6747

What it actually does

Information leakage vulnerability in mknotifyd allows an attacker to retrieve potentially sensitive data without authentication.

Why it matters to the business

Attackers may obtain internal configuration or operational data that can be used to plan further attacks against the monitoring environment, increasing overall risk exposure especially in widely deployed Checkmk instances.

How an attack unfolds

An unauthenticated attacker sends crafted requests directly to the mknotifyd component, causing it to return sensitive internal data that would otherwise be inaccessible.

How to fix it

Upgrade Checkmk to version 2.3.0p18 or later, 2.2.0p36 or later, 2.1.0p49 or later, or 2.0.0p39 for the EOL branch. Apply the fixed commit 6a686961c4b760c55a13cfdb61e7c02be832a0be for GIT installations.

How to confirm the fix worked

Verify the installed Checkmk version against the fixed releases and confirm mknotifyd no longer returns sensitive data on unauthenticated requests.

Typical attack path

1. Identify exposed Checkmk instance running vulnerable mknotifyd
2. Send unauthenticated requests targeting the notification daemon
3. Extract leaked sensitive data from responses
4. Use obtained information to escalate attacks against the monitored environment

How to detect it

Review web server and Checkmk logs for unexpected unauthenticated access attempts to mknotifyd endpoints and inspect responses containing internal data.

What your security team should do

• Immediately upgrade affected Checkmk installations to the specified fixed versions
• Restrict network access to the mknotifyd service where possible
• Monitor for unusual requests to notification endpoints