Headline
CVE-2022-46303: Fix command injection in SMS notification script
Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application’s local permissions.
Component
Notifications
Title
Fix command injection in SMS notification script
Date
Aug 1, 2022
Checkmk Edition
Checkmk Raw (CRE)
Checkmk Version
2.2.0b1 2.1.0p11 2.0.0p28 1.6.0p30
Level
Trivial Change
Class
Security Fix
Compatibility
Compatible - no manual interaction needed
Previous to this Werk it was possible to inject arbitrary shell commands when sending SMS notifications. For this, attackers would have needed to place a crafted string in a user’s Pager Address, which was not properly escaped by the SMS script.
In most setups, this issue will not be exploitable: Changing a user’s Pager Address requires the User Management permission. Users with that permission are effectively Administrators and can thus already legitimately execute code in the Site context. Note however, that in some setups the attribute can also be configured by external interfaces, for example via LDAP User Synchronization.
Affected Versions: All currently supported versions are affected: 1.6, 2.0, and 2.1.
Mitigations: As an immediate mitigation all notifications via the method "SMS (using smstools)" can be disabled. Note that users’ personal notification rules are affected as well.
Indicators of Compromise: If you suspect this issue might have been exploited in your installation, validate users’ Pager Address fields. Check the Audit Log for changes to this field.
Vulnerability Management: We have rated the issue with a CVSS Score of 8.0 (High) with the following CVSS vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. A CVE has been requested.
Changes: This Werk replaces a hazardous call to os.system by a safer alternative and adds additional validation to the Pager Address before attempting to send SMS to it. Valid Pager Addresses may now include letters, numbers, space characters, any of the characters . / - (), as well as a + character at the beginning.
To the list of all Werks