Checkmk omd Local Privilege Escalation Vulnerability (Werk #18891) and Mitigation

Vulnerability Summary: Werk #18891 - omd Local Privilege Escalation Vulnerability Overview A critical local privilege escalation vulnerability exists in the Checkmk system when the management command is executed with root privileges. Attack Scenario: A standard site user can exploit this mechanism to escalate privileges to root. Trigger: This escalation can be triggered automatically via standard system operations (such as post-update triggers). Risk: If multiple sites share a server, a compromised site user can take over the entire host; if MKP uploads are allowed, an attacker can bypass restrictions to gain full root access. Scope of Impact Affected Checkmk versions include: Checkmk Community Checkmk Pro Checkmk Ultimate Checkmk Ultimate MT Specific Affected Versions: 2.5.0 (beta) 2.4.0 2.3.0 2.2.0 (EOL, upgrade to 2.3.0 or higher recommended) CVSS Score: 9.3 Critical Remediation and Mitigation 1. Core Remediation Steps Do not interact with sites using the command as the root user until a patched version is installed. Running the standard package installer will automatically update and fix the vulnerability. 2. Safe Interaction Methods Even if not updated, the following commands are safe when run as a site user: 3. Dangerous Commands to Avoid The following commands are unsafe when executed as the root user on older Checkmk versions prior to uninstallation: 4. Alternative Solutions (For Commands Requiring Root Privileges) For commands requiring root privileges, such as and , they should be run as a site user. If you need to extract the original site name from a backup archive, use the following command: Once the exact name is obtained, create and restore the site within the site context: 5. Verification Scripts Check if a specific version is patched: Check the status of all installed versions:

Goal Reached Thanks to every supporter — we hit 100%!

Checkmk omd Local Privilege Escalation Vulnerability (Werk #18891) and Mitigation