CVE-2024-5741 in Checkmk
Summary
by MITRE • 06/17/2024
Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/23/2025
The vulnerability identified as CVE-2024-5741 represents a stored cross-site scripting flaw within the inventory tree rendering functionality of Checkmk monitoring software. This issue affects multiple versions including the end-of-life 2.0.0 release and various patch levels of the 2.1.x, 2.2.x, and 2.3.x series. The vulnerability stems from insufficient input validation and output encoding mechanisms when processing inventory data that is rendered within the web interface's tree structure visualization components. Attackers can exploit this weakness by injecting malicious script code into inventory items that are subsequently displayed to authenticated users.
The technical implementation of this vulnerability occurs at the point where inventory data is stored and later retrieved for display within the web application's tree rendering system. When administrators or users add inventory items containing malicious script payloads, these inputs are not properly sanitized or encoded before being rendered in the HTML output. This creates a persistent XSS vector where the malicious code executes in the context of other users' browsers who view the affected inventory tree. The flaw specifically impacts the inventory tree rendering module and does not affect other components of the monitoring platform, making it a targeted vulnerability within the application's user interface layer.
The operational impact of CVE-2024-5741 is significant for organizations relying on Checkmk for system monitoring and infrastructure management. An attacker with access to the monitoring platform can craft malicious inventory entries that, when viewed by other users, can execute arbitrary JavaScript code in their browsers. This could enable session hijacking, credential theft, or redirection to malicious sites. The vulnerability affects both administrators and regular users who have access to the inventory tree functionality, creating a broad attack surface. Given that Checkmk is widely used for critical infrastructure monitoring, the potential for lateral movement within networks or data exfiltration makes this a serious security concern. The stored nature of the vulnerability means that malicious payloads persist even after the initial injection, making detection and remediation more challenging.
Organizations should immediately upgrade to the patched versions of Checkmk including 2.3.0p7, 2.2.0p28, 2.1.0p45, or equivalent security patches for their respective version lines. The vulnerability aligns with CWE-79 which classifies cross-site scripting as a common web application security weakness, and follows patterns typically addressed through proper input validation and output encoding. From an ATT&CK framework perspective, this vulnerability maps to T1566.001 (Phishing via Service) and T1059.007 (Command and Scripting Interpreter: JavaScript) as it enables attackers to execute malicious scripts in user browsers. Administrators should also implement monitoring for unusual inventory data entries and consider implementing additional access controls to limit who can add inventory items. The fix typically involves proper HTML encoding of all user-supplied data before rendering in the web interface, ensuring that any script content is treated as data rather than executable code.