CVE-2024-8606

What it actually does

The flaw permits authenticated users to bypass two-factor authentication checks specifically when accessing the RestAPI, allowing full API functionality without completing the second authentication factor.

Why it matters to the business

Attackers who obtain valid credentials can reach monitoring data and controls without the intended second-factor protection, increasing risk of unauthorized infrastructure visibility and potential lateral movement in environments using Checkmk.

How an attack unfolds

An attacker first obtains valid credentials for a Checkmk user account, then crafts RestAPI requests that trigger authentication flows while evading the two-factor verification step, resulting in an authenticated session without providing the second factor.

How to fix it

Upgrade Checkmk installations to version 2.3.0p16 or 2.2.0p34 or later to enforce 2FA on RestAPI access.

How to confirm the fix worked

Confirm the running Checkmk version meets or exceeds 2.3.0p16 or 2.2.0p34, then attempt RestAPI authentication both with and without a second factor to verify enforcement.

Typical attack path

1. Acquire valid Checkmk user credentials through phishing, credential stuffing, or other means
2. Identify and target RestAPI endpoints
3. Submit authentication requests crafted to skip 2FA enforcement
4. Obtain fully authenticated API access

How to detect it

Examine RestAPI access and authentication logs for successful logins that lack corresponding 2FA events or tokens; correlate with unusual API usage patterns post-authentication.

What your security team should do

• Apply the listed version upgrades immediately on all affected instances
• Audit RestAPI access logs for any anomalous successful authentications
• Review and strengthen credential hygiene and monitoring around Checkmk deployments