Checkmk werks security September 2016

checkmk-werks-sec@lists.checkmk.com

1 participants
1 discussions

Check_MK Werk 3855: Fixed possible command injection by privileged WATO users

by Lars Michelsen

ID: 3855 Title: Fixed possible command injection by privileged WATO users Component: WATO Level: 2 Class: Security Fix Version: 1.4.0i1 In all previous 1.2.8 versions authenticated and privileged WATO users, the ones which are able to add or edit hosts, were able to inject shell commands to Check_MK which are then executed in the context of the monitoring site user. The user was able to configure a host address in a specific format to inject such shell commands to the configuration. Once the configuration was activated and loaded into the monitoring core, the command was executed in context of the monitoring site user in the moment a parent scan was started for that host. Thanks for analyzing and reporting this issue to Christian Fünfhaus!

7 years, 8 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

Checkmk werks security September 2016