Improper neutralization of Livestatus command delimiters in the autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands. This vulnerability poses a medium risk due to its potential impact on system integrity and confidentiality.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-32918 |
Exploitation
To exploit this vulnerability, an authenticated user can send specially crafted requests to the autocomplete endpoint of the RestAPI, injecting arbitrary Livestatus commands. This can lead to unauthorized access or manipulation of system data, depending on the commands executed.
Affected Products
- Checkmk versions <2.4.0p6: Affected by improper command delimiter handling.
- Checkmk versions <2.3.0p35: Vulnerable to command injection through the RestAPI.
- Checkmk versions <2.2.0p44: Allows for potential exploitation via Livestatus commands.
- Checkmk version 2.1.0 (EOL): End of life version still susceptible to this issue.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Checkmk that addresses this issue. Additionally, implementing strict input validation and sanitization for user inputs in the RestAPI can help prevent command injection attacks.