CVE-2026-33455

Executive Summary

CVE-2026-33455 is a Livestatus injection vulnerability in Checkmk monitoring software, affecting versions prior to 2.5.0b4. An authenticated attacker can inject arbitrary Livestatus commands via the search query in the monitoring quicksearch feature. This is due to insufficient input sanitization in search filter plugins. The vulnerability has a CVSS score of 6.3 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood. No public proof-of-concept or exploit code is available at this time. The vendor has released a patched version (2.5.0b4) to address the issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be authenticated
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is considered Medium due to the requirement for authentication and the limited impact on confidentiality, integrity, and availability. However, the ability to inject Livestatus commands could allow an attacker to query or manipulate monitoring data, potentially leading to further compromise.

Deep Dive & Mechanics

The vulnerability resides in the monitoring quicksearch functionality of Checkmk. The quicksearch feature allows users to search for hosts, services, and other monitoring objects. The search query is processed by search filter plugins that construct Livestatus queries. Due to insufficient input sanitization, an authenticated attacker can inject arbitrary Livestatus commands by crafting a malicious search query.

Livestatus is a protocol used by Checkmk to query monitoring data from the Checkmk Monitoring Core (CMC). By injecting Livestatus commands, an attacker can:

• Retrieve sensitive monitoring data (e.g., host configurations, service states)
• Modify monitoring data (e.g., acknowledge problems, disable notifications)
• Potentially execute commands on the monitoring server if the Livestatus interface is misconfigured

The injection occurs because the search filter plugins do not properly escape or validate user input before incorporating it into Livestatus queries. This allows an attacker to break out of the intended query structure and inject arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.5.0b4): The vulnerable code likely constructs a Livestatus query by directly concatenating user input without sanitization. For example:

def search_filter_plugin(query):
    livestatus_query = "GET hosts\nColumns: name\nFilter: name ~ " + query
    result = execute_livestatus(livestatus_query)
    return result

Patched Code (2.5.0b4): The patched code properly sanitizes user input by escaping special characters or using parameterized queries. For example:

def search_filter_plugin(query):
    sanitized_query = sanitize_livestatus_input(query)
    livestatus_query = "GET hosts\nColumns: name\nFilter: name ~ " + sanitized_query
    result = execute_livestatus(livestatus_query)
    return result

The sanitize_livestatus_input function would escape or reject characters that have special meaning in Livestatus, such as newlines, semicolons, or pipe characters.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Checkmk instance (version < 2.5.0b4)
• Valid credentials for an authenticated user

Exploitation Steps:

1. Log in to the Checkmk web interface.
2. Navigate to the monitoring quicksearch feature (typically accessible from the main dashboard).
3. Enter a crafted search query containing Livestatus injection payloads. For example:

   test\nGET hosts\nColumns: name\n
   

   This payload attempts to break out of the original query and execute a new Livestatus command to retrieve host names.
4. Observe the response for injected data.

Example Payload:

test\nGET hosts\nColumns: name\nFilter: name = *

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor web application logs for unusual search queries containing special characters (e.g., newlines, semicolons, pipes).
• Implement input validation and sanitization for all user-supplied data in search queries.
• Use Web Application Firewall (WAF) rules to block Livestatus injection attempts.

Hunting:

• Search for search queries that contain multiple lines or command-like structures.
• Correlate with authentication logs to identify the user performing the injection.

Response:

• Immediately isolate the affected Checkmk instance.
• Review logs for any successful injection attempts.
• Apply the vendor patch (upgrade to 2.5.0b4 or later).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to Checkmk web interface with search queries containing newline characters (%0a or \n) or other special characters.
  • Unusual Livestatus commands in monitoring logs.

• Host IOCs:

  • Unexpected changes to monitoring configurations (e.g., acknowledgments, downtimes).
  • Unauthorized access to sensitive monitoring data.

• Log IOCs:

  • Web server logs showing search queries with injection patterns.
  • Checkmk application logs showing Livestatus errors or unexpected queries.

Detection Engineering

YARA Rule

rule CVE_2026_33455_Livestatus_Injection {
    meta:
        description = "Detects Livestatus injection attempts in Checkmk search queries"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-33455"
    strings:
        $injection1 = /GET\s+(hosts|services|contacts|commands)/i
        $injection2 = /Filter:\s*\w+\s*[=~!<>]/
        $injection3 = /Columns:\s*\w+/
        $injection4 = /\n/
    condition:
        any of ($injection*) and #injection4 > 1
}

Sigma Rule

title: Checkmk Livestatus Injection via Quicksearch
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Livestatus injection attempts in Checkmk search queries
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-33455
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-uri-query|contains:
            - '%0a'
            - '%0d'
            - 'GET '
            - 'Filter:'
            - 'Columns:'
    condition: selection
falsepositives:
    - Legitimate use of special characters in search queries
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-33455 Checkmk Livestatus Injection Attempt"; flow:to_server,established; content:"GET"; http_uri; nocase; content:"Filter:"; http_uri; nocase; content:"Columns:"; http_uri; nocase; pcre:"/%0a|%0d/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Checkmk to version 2.5.0b4 or later.
2. If immediate upgrade is not possible, restrict access to the quicksearch feature to trusted users only.
3. Implement input validation and sanitization for all search queries.

Long-term Measures:

• Regularly update Checkmk to the latest version.
• Conduct security audits of custom plugins and integrations.
• Implement Web Application Firewall (WAF) rules to block injection attempts.
• Monitor for unusual Livestatus queries in logs.

Workarounds:

• Disable the quicksearch feature if not required.
• Use network segmentation to limit access to the Checkmk web interface.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 2D7FF3F0AACDB90BA712EEEE] */}