CVE-2026-33456

Executive Summary

CVE-2026-33456 is a Livestatus injection vulnerability in Checkmk, an IT monitoring solution. An authenticated attacker with access to the notification test page can inject arbitrary Livestatus commands via a crafted service description. This allows the attacker to execute arbitrary commands on the monitoring server, potentially leading to full system compromise. The vulnerability affects Checkmk versions prior to 2.5.0b4 and 2.4.0p26. A patch is available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct vulnerability in the Checkmk software itself. The risk is to organizations using Checkmk for monitoring.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Requires an authenticated user with access to the notification test page.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability allows authenticated users to execute arbitrary commands, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the notification test mode of Checkmk. When testing notifications, the application constructs a Livestatus query using user-supplied input, specifically the service description. The input is not properly sanitized, allowing an attacker to inject arbitrary Livestatus commands.

Livestatus is a protocol used by Checkmk to query monitoring data. By injecting commands, an attacker can:

• Execute arbitrary shell commands on the monitoring server.
• Read, modify, or delete monitoring data.
• Potentially pivot to other systems within the network.

The injection occurs because the service description is directly concatenated into a Livestatus query without proper escaping or validation.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Direct concatenation of user input
query = "GET services\nFilter: description = " + user_input

Patched Code (Conceptual):

# Patched: Proper escaping of user input
from livestatus import escape
query = "GET services\nFilter: description = " + escape(user_input)

The patch introduces proper escaping of the service description before it is used in the Livestatus query, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Checkmk instance with a user account that has access to the notification test page.
• Knowledge of the Livestatus protocol.

Exploitation Steps:

1. Log in to the Checkmk web interface.
2. Navigate to the notification test page (e.g., wato.py?mode=test_notification).
3. In the service description field, inject a Livestatus command. For example:

   test; command: execute; command: /bin/bash -c 'id > /tmp/pwned'
   

4. Submit the form. The injected command will be executed on the server.

Proof of Concept (PoC):

# Using curl to send a crafted request
curl -X POST "https://target/checkmk/wato.py?mode=test_notification" \
  -d "_username=admin&_password=secret&service_description=test;%20command:%20execute;%20command:%20/bin/bash%20-c%20'id%20>%20/tmp/pwned'"

Blue Team

Detection:

• Monitor for unusual Livestatus queries in logs.
• Look for patterns like command: or execute: in service descriptions.
• Use the detection rules provided below.

Hunting:

• Search for service descriptions containing special characters like ;, |, or &.
• Review logs for failed authentication attempts followed by successful exploitation.

Indicators of Compromise (IOCs)

• Network: Unusual Livestatus queries containing command: or execute:.
• Host: Unexpected files in /tmp/ or other writable directories.
• Logs: Checkmk logs showing injection attempts in service descriptions.
• Processes: Unexpected shell processes spawned by the Checkmk user.

Detection Engineering

YARA Rule

rule CVE_2026_33456_Checkmk_Livestatus_Injection {
    meta:
        description = "Detects Livestatus injection attempts in Checkmk logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-33456"
    strings:
        $injection1 = /service_description=.*;.*command:.*execute/
        $injection2 = /service_description=.*\|.*command/
        $injection3 = /service_description=.*&.*command/
    condition:
        any of them
}

Sigma Rule

title: Checkmk Livestatus Injection Attempt
id: cve-2026-33456
status: experimental
description: Detects attempts to exploit CVE-2026-33456 via crafted service descriptions
author: Valters IT
logsource:
    product: checkmk
    service: web
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'mode=test_notification'
        cs-uri-query|contains|all:
            - 'service_description='
            - 'command:'
    condition: selection
falsepositives:
    - Legitimate use of special characters in service descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-33456 Checkmk Livestatus Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"mode=test_notification"; http_uri;
    content:"service_description="; http_client_body;
    pcre:"/command\s*:\s*execute/i";
    sid:1000001;
    rev:1;
    reference:cve,2026-33456;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Checkmk 2.5.0b4 or 2.4.0p26.
2. If immediate upgrade is not possible, restrict access to the notification test page to trusted users only.
3. Monitor logs for suspicious activity.

Long-term Mitigations:

• Implement network segmentation to limit access to the Checkmk web interface.
• Use a Web Application Firewall (WAF) to filter malicious requests.
• Regularly review and audit user permissions.

Patch Details:

• Upgrade to Checkmk 2.5.0b4 or 2.4.0p26.
• The patch introduces proper input sanitization for the service description field.

Valters IT

{/* [Security Hash: 16741D4294A0023020B725C7] */}