id: checkmk-info-disclosure

info:
  name: Checkmk Agent Info Disclosure
  author: ivaldivieso,s4e-io
  severity: medium
  description: |
    The Checkmk agent had exposed sensitive system information on TCP port 6556 without requiring authentication.
  reference:
    - https://medium.com/@Th3hound/the-hidden-danger-of-the-exposed-checkmk-agent-mapping-your-infrastructure-for-attackers-151cc2180e73
  metadata:
    verified: true
    shodan-query: product:"check_mk"
  tags: tcp,network,checkmk,unauth,discovery

tcp:
  - inputs:
      - data: "\n"

    host:
      - "{{Hostname}}"
    port: 6556
    read-size: 1024

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<<<check_mk>>>"

      - type: word
        words:
          - "AgentOS:"
          - "Version:"
        condition: or

      - type: word
        words:
          - "HTTP/1.1"
        negative: true
# digest: 490a0046304402203d93c8bc3581136a2a7e3435e98426f31f75fe5ad9f6ed5d9cfed6ba6af9db5b02201be8e4837c675880a8f2e8b619d4d53199de3a2dc0272cf34f7fe9c3ef7539ac:922c64590222798bb761d5b6d8e72950