Checkmk CVE-2025-3506 Unauthenticated Access to Agent Files

Critical Vulnerability Information Component: Site management Title: Disable access to check_mk/local/agents/ Date: Apr 8, 2025 Level: Trivial Change Category: Security Fix Compatibility: Incompatible - Manual interaction might be required Affected Versions: - 2.4.0 (beta) - 2.3.0 - 2.2.0 - 2.1.0 (EOL) Vulnerability Description Checkmk provides built-in agents and plugins via http(s)://fqdn/sitename/check_mk/agents/ without authentication. This allows customers to easily install default agents. Custom agents stored in local/share/check_mk/agents are also served in the same way. If the "Deploy custom files with agent" rule is used, the same path is utilized. As a result, these custom files may contain sensitive information. Mitigation This is a significant change and is unlikely to be backported to 2.3.0 and 2.2.0. All files in local/share/check_mk/agents should be reviewed to ensure they do not contain any sensitive information. The path can be manually disabled by adding a custom configuration file, e.g., etc/apache/conf.d/000_werk_17348.conf, with the following content: Compromise Indicators If files in local/share/check_mk/agents contain sensitive data, check Apache access logs in var/log/apache/access_log to determine if these files have been accessed. Vulnerability Management This issue has been rated as a medium risk with a CVSS score of 6.3 and has been assigned CVE-2025-3506.

Goal Reached Thanks to every supporter — we hit 100%!

Checkmk CVE-2025-3506 Unauthenticated Access to Agent Files