CyberRota Analysis
AI-GeneratedThe Checkmate tool versions 3.3.0 to 3.9.2 are vulnerable due to a misconfiguration that allows unauthenticated users to access sensitive monitor objects, including secret HTTP Authorization credentials, through the GET /api/v1/status-page/:url endpoint. This exposure can lead to unauthorized access to monitored services, posing a significant security risk. Organizations using affected versions should prioritize upgrading to version 3.9.2 to mitigate potential credential theft and service compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.