Werk #3855: Fixed possible command injection by privileged WATO users

Component Setup
Title Fixed possible command injection by privileged WATO users
Date Sep 13, 2016
Checkmk Edition Checkmk Raw (CRE)
Checkmk Version 1.2.8p11 1.4.0i1
Level Prominent Change
Class Security Fix
Compatibility Compatible - no manual interaction needed

In all previous 1.2.8 versions authenticated and privileged WATO users, the ones which are able to add or edit hosts, were able to inject shell commands to Check_MK which are then executed in the context of the monitoring site user.

The user was able to configure a host address in a specific format to inject such shell commands to the configuration. Once the configuration was activated and loaded into the monitoring core, the command was executed in context of the monitoring site user in the moment a parent scan was started for that host.

Thanks for analyzing and reporting this issue to Christian Fünfhaus!

To the list of all Werks