Tribe29 Checkmk up to 1.6.0/2.0.0p28/2.1.0p11 Livestatus Query Language injection

Summaryinfo

A vulnerability was found in Tribe29 Checkmk up to 1.6.0/2.0.0p28/2.1.0p11. It has been declared as critical. Affected is an unknown function of the component Livestatus Query Language Handler. Such manipulation leads to injection. This vulnerability is listed as CVE-2022-47909. The attack must be carried out from within the local network. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Tribe29 Checkmk up to 1.6.0/2.0.0p28/2.1.0p11. Affected by this issue is some unknown processing of the component Livestatus Query Language Handler. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from localhost.

The weakness was presented 02/20/2023. The advisory is shared for download at checkmk.com. This vulnerability is handled as CVE-2022-47909 since 01/18/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1055.

The vulnerability scanner Nessus provides a plugin with the ID 253223 (Linux Distros Unpatched Vulnerability : CVE-2022-47909), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (253223). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Tribe29

Name

• Checkmk

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6.0
• 2.0.0p28
• 2.1.0p11

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion