Checkmk Livestatus Command Injection Vulnerability in REST API Autocomplete Endpoint

A command injection vulnerability has been identified in the autocomplete endpoint of the Checkmk REST API. This issue affects versions prior to 2.4.0p6, prior to 2.3.0p35, prior to 2.2.0p44, and 2.1.0 (EOL). The vulnerability allows authenticated users to inject arbitrary Livestatus commands by exploiting improper validation of command delimiters in the endpoint.

Impact

Exploitation of this vulnerability allows for unauthorized injection of Livestatus commands by authenticated users, potentially leading to unauthorized actions or data manipulation within Checkmk.

Remediation

Users can upgrade to Checkmk versions 2.4.0p6, 2.3.0p35, 2.2.0p44, or the upcoming 2.5.0b1 to address this vulnerability.