CVE-2024-47091

Executive Summary

CVE-2024-47091 is a privilege escalation vulnerability in the mk_mysql agent plugin on Windows systems running Checkmk. A local unprivileged user can exploit this by creating a Windows service named 'MySQL' or 'MariaDB', or by gaining write access to a binary referenced by such a service. This allows arbitrary code execution in the context of the Checkmk agent service, which typically runs as SYSTEM, the highest privilege level on Windows. The vulnerability affects Checkmk versions prior to 2.4.0p29, prior to 2.3.0p47, and the end-of-life (EOL) version 2.2.0. No public proof-of-concept (PoC) or exploit code is currently available, but the attack vector is well-defined and poses a significant risk in environments where local users have the ability to create services.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core product vulnerability in the Checkmk monitoring solution. The attack surface is limited to local access, but the impact is severe due to the potential for full system compromise.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required beyond the ability to create a service.
• Privileges Required: Low (PR:L) – The attacker needs a local unprivileged account.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not cross a trust boundary.
• Confidentiality Impact: High (C:H) – Full access to sensitive data.
• Integrity Impact: High (I:H) – Full control over system files and configurations.
• Availability Impact: High (A:H) – Potential for denial of service or system disruption.

Threat Level: High. While the attack requires local access, the ability to escalate to SYSTEM privileges makes it a critical risk in multi-user environments or after an initial foothold.

Deep Dive & Mechanics

The vulnerability resides in the mk_mysql plugin of the Checkmk agent on Windows. This plugin is designed to monitor MySQL and MariaDB databases by connecting to the database service. The plugin interacts with Windows services named 'MySQL' or 'MariaDB' to gather performance metrics.

Root Cause: The plugin does not properly validate the integrity or origin of the Windows service it interacts with. A local unprivileged user can create a malicious Windows service named 'MySQL' or 'MariaDB' (or modify an existing one if they have write access to the binary path). When the Checkmk agent runs the mk_mysql plugin, it will connect to this malicious service, which can execute arbitrary code with the privileges of the Checkmk agent service (typically SYSTEM).

Attack Flow:

1. An attacker gains local access to a Windows system running a vulnerable Checkmk agent.
2. The attacker creates a Windows service named 'MySQL' or 'MariaDB' with a malicious binary path (e.g., cmd.exe /c malicious_script.bat).
3. The Checkmk agent periodically executes the mk_mysql plugin.
4. The plugin attempts to query the MySQL/MariaDB service and inadvertently triggers the malicious service.
5. The malicious service executes the attacker's code with SYSTEM privileges.

Why This Works: The plugin relies on the service name to identify the database instance but does not verify that the service is legitimate or that the binary path is trusted. This is a classic case of insecure service interaction.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable plugin likely uses a Windows API call like OpenSCManager and OpenService to find a service named 'MySQL' or 'MariaDB', then executes a query against it without verifying the service's binary path or digital signature.

# Vulnerable pseudo-code
import win32serviceutil
import win32service

def get_mysql_status():
    try:
        # Opens the service without validation
        hscm = win32service.OpenSCManager(None, None, win32service.SC_MANAGER_ENUMERATE_SERVICE)
        hsvc = win32service.OpenService(hscm, 'MySQL', win32service.SERVICE_QUERY_STATUS)
        # ... query service status
    except:
        pass

Patched Code (Conceptual): The patched version should validate the service's binary path against a known list of legitimate MySQL/MariaDB installation paths, or check for a digital signature.

# Patched pseudo-code
import win32serviceutil
import win32service
import os

def get_mysql_status():
    try:
        hscm = win32service.OpenSCManager(None, None, win32service.SC_MANAGER_ENUMERATE_SERVICE)
        hsvc = win32service.OpenService(hscm, 'MySQL', win32service.SERVICE_QUERY_CONFIG)
        # Get the binary path
        config = win32service.QueryServiceConfig(hsvc)
        binary_path = config[3]  # lpBinaryPathName
        # Validate the path
        if not is_legitimate_mysql_path(binary_path):
            raise Exception("Service binary path is not legitimate")
        # ... query service status
    except:
        pass

def is_legitimate_mysql_path(path):
    # Check against known installation directories
    legitimate_paths = [
        r"C:\Program Files\MySQL\MySQL Server 8.0\bin\mysqld.exe",
        r"C:\Program Files\MariaDB 10.6\bin\mysqld.exe",
        # ... other known paths
    ]
    return path.lower() in [p.lower() for p in legitimate_paths]

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Windows 10/11 or Windows Server 2019/2022
• Checkmk agent version 2.3.0p46 (vulnerable)
• Local user account with standard privileges

Exploitation Steps:

1. Create a Malicious Service: Open a command prompt as a standard user and create a service named 'MySQL' that executes a reverse shell or other payload.

   sc create MySQL binPath= "cmd.exe /c powershell -NoP -NonI -W Hidden -Exec Bypass -Enc <base64_encoded_reverse_shell>" start= auto
   

2. Trigger the Plugin: Wait for the Checkmk agent to run the mk_mysql plugin (typically every minute) or manually trigger it if possible.

   check_mk_agent.exe mk_mysql
   

3. Escalate Privileges: The malicious service runs with SYSTEM privileges, granting full control over the system.

Alternative Method (Write Access): If the attacker has write access to the binary path of an existing MySQL/MariaDB service, they can replace the binary with a malicious one.

Blue Team (Defender)

Detection Steps:

1. Monitor Service Creation: Look for new services named 'MySQL' or 'MariaDB' created by non-privileged users.

   Get-WmiObject -Class Win32_Service | Where-Object { $_.Name -match 'MySQL|MariaDB' -and $_.StartName -ne 'LocalSystem' }
   

2. Audit Service Binary Paths: Verify that the binary paths of MySQL/MariaDB services point to legitimate installation directories.

   Get-WmiObject -Class Win32_Service | Where-Object { $_.Name -match 'MySQL|MariaDB' } | Select-Object Name, PathName, StartName
   

3. Check for Unusual Processes: Monitor for processes spawned by the Checkmk agent service that are not typical database binaries.

Indicators of Compromise (IOCs)

• Service Name: 'MySQL' or 'MariaDB' created by a non-privileged user.
• Service Binary Path: Points to cmd.exe, powershell.exe, or other non-standard executables.
• Event ID 7045 (Service Creation): A new service was installed on the system.
• Event ID 4697 (Security Log): A service was installed in the system.
• Process Tree: check_mk_agent.exe spawning cmd.exe or powershell.exe with suspicious arguments.

Detection Engineering

YARA Rule

rule CVE_2024_47091_Checkmk_PrivEsc {
    meta:
        description = "Detects exploitation of CVE-2024-47091 via malicious service creation"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47091"
    strings:
        $s1 = "MySQL" nocase
        $s2 = "MariaDB" nocase
        $s3 = "binPath=" nocase
        $s4 = "cmd.exe" nocase
        $s5 = "powershell.exe" nocase
    condition:
        (($s1 or $s2) and $s3) and ($s4 or $s5)
}

Sigma Rule

title: CVE-2024-47091 - Checkmk Privilege Escalation via Malicious Service
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of a service named 'MySQL' or 'MariaDB' with a non-standard binary path, indicating exploitation of CVE-2024-47091.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47091
logsource:
    product: windows
    service: security
    definition: 'Requirements: Audit Security Group Management must be enabled'
detection:
    selection:
        EventID: 4697
        ServiceName|contains:
            - 'MySQL'
            - 'MariaDB'
        ServiceFileName|contains:
            - 'cmd.exe'
            - 'powershell.exe'
    condition: selection
falsepositives:
    - Legitimate MySQL/MariaDB installations (rarely use cmd.exe or powershell.exe as binary path)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47091 - Checkmk Agent Potential Reverse Shell"; flow:to_server,established; content:"|48 54 54 50 2f 31 2e 31|"; nocase; content:"cmd.exe"; nocase; content:"powershell"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Checkmk Agent: Update to version 2.4.0p29, 2.3.0p47, or later. Version 2.2.0 is EOL and must be upgraded to a supported branch.
2. Restrict Service Creation: Use Group Policy to restrict who can create services on Windows systems.
3. Audit Existing Services: Review all services named 'MySQL' or 'MariaDB' to ensure they are legitimate.

Long-Term Mitigations:

• Principle of Least Privilege: Ensure that local users do not have unnecessary permissions to create services.
• Application Whitelisting: Use AppLocker or Windows Defender Application Control to block unauthorized executables.
• Monitor Checkmk Agent Logs: Enable detailed logging for the Checkmk agent to detect anomalous plugin behavior.

Workaround (If Patching Is Not Possible):

• Disable the mk_mysql plugin if it is not required.
• Manually validate the integrity of MySQL/MariaDB services on a regular basis.

Valters IT