Local Privilege Escalation via writable files in Checkmk Agent


Local Privilege Escalation via writable files


Checkmk Agent

Vulnerable Version

2.0.0, 2.1.0, 2.2.0

Fixed Version

2.1.0p40, 2.2.0p23, 2.3.0b1, 2.4.0b1

CVE Number







Michael Baer (Office Fürth) | SEC Consult Vulnerability Lab

The Checkmk agent allows a local privilege escalation on a Windows system. The agent creates and executes temporary files that can be manipulated by an attacker.

Vendor description

"Checkmk 2.2 has arrived – and is ready to monitor your hybrid IT infrastructure with new features for monitoring native cloud applications, OpenShift support, an expanded REST API, UX improvements, enhanced integrations and over 174 new or reworked checks and agents. Monitor your cloud assets from top hyperscalers with Checkmk 2.2 in addition to the powerful monitoring of your on-premises networks and servers."

Source: https://checkmk.com/product/latest-version


Business recommendation

The vendor provides a patch which should be installed immediately.

SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.

Vulnerability overview/description

1) Local Privilege Escalation via writable files (CVE-2024-0670)

In some cases, the software creates temporary files inside the directory C:\Windows\Temp that get executed afterwards. An attacker can leverage this to place write-protected malicious files in the directory beforehand. The files get executed by Checkmk with SYSTEM privileges allowing attackers to escalate their privileges.

Proof of concept

1) Local Privilege Escalation via writable files (CVE-2024-0670)

In the first step, the filename that will be used by Checkmk needs to be found. The application creates temporary files with name cmk_{}_{}_{}.cmd. The placeholders are replaced with a string, the process id and a counter. The first string was always 'all' and the counter usually is 0. The process id is not exactly predictable. However, Windows assigns those numbers in increasing order. This allows to observe the currently used process ids and define a limited range of probable ids.

In the second step, the attacker places the malicious binary into the folder C:\Windows\Temp multiple times. The filenames are constructed using the above pattern for all different probable ids. After placing the files, the attacker marks them as read-only. Both can be automated using the following powershell command. Here, the range of probable ids was determined to be between 10000 and 30000. The file C:\Users\attacker\Desktop\mal.exe is the malicious file.

10000..30000 | foreach {
	copy C:\Users\attacker\Desktop\mal.exe C:\Windows\Temp\cmk_all_${_}_1.cmd;
	Set-ItemProperty -path C:\Windows\Temp\cmk_all_${_}_1.cmd -name IsReadOnly -value $true;

For this proof of concept, a binary was created using msfvenom that executes the command whoami and writes the result to a file. This will allow to verify the successful execution as the SYSTEM user. The following command was used:

msfvenom -p windows/exec CMD='cmd /c "whoami > C:\abc\file"' -f exe -o mal.exe

It should be noted, that the folder C:\abc has to exist and that the anti-virus solution must be disabled to execute this particular binary.

The final step is to force Checkmk to write and execute those temporary files.

It was observed that repairing the software is enough. This repair process can be initiated via the Windows GUI or using the following command. The name fafda3e.msi will be different on every system. The folder C:\Windows\Installer can be investigated to find the correct name on a given system.

msiexec /fa C:\Windows\Installer\fafda3e.msi

After the repairing finished, the file written by the malicious binary can be checked. It was created and contains the string "nt authority\system".

Vulnerable / tested versions

The following version has been tested:

  • 2.1.0

According to the vendor, the following versions are affected:

  • 2.0.0
  • 2.1.0
  • 2.2.0

Vendor contact timeline

2024-01-15 Contacting vendor through security@checkmk.com
2024-01-18 Vendor confirms vulnerability, assigns CVE, and prepares a fix
2024-01-26 Providing credits and acknowledging CVSS score.
2024-03-04 Vendor informs us that fixes with Werk #16361 are available.
2024-03-07 Coordinated release of security advisory.


Install the latest version 2.1.0p40 or 2.2.0p23 from the vendor's download page: https://checkmk.com/download

More information can be found within the vendor's security advisory: https://checkmk.com/werk/16361




Advisory URL


EOF Michael Baer  / @2024


Interested to work with the experts of SEC Consult? Send us your application

Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices