Attack Chain

1. Attacker performs reconnaissance to identify a CheckCle instance exposed to the internet.
2. Attacker probes the /api/collections/ endpoint to determine if PocketBase is accessible without authentication.
3. Attacker identifies available collections by querying the API catalog.
4. Attacker crafts HTTP GET or POST requests to retrieve or modify records within identified collections.
5. Attacker exfiltrates sensitive data, such as server_token values and alert_configurations secrets, via API responses.
6. Attacker modifies or deletes records to disable security alerting or manipulate incident status pages.
7. Attacker successfully disrupts system monitoring and achieves unauthorized persistence through configuration tampering.

Impact

The vulnerability carries a CVSS 3.1 base score of 9.8. Exploitation leads to full unauthorized access to monitored infrastructure data. This can result in complete loss of confidentiality regarding server tokens and alert mechanisms, as well as loss of integrity and availability of monitoring status and alerting systems. Any organization using CheckCle version 1.6.0 or earlier is potentially exposed to data theft and the weaponization of the monitoring platform itself.

Recommendation

1. Upgrade CheckCle to the latest available version beyond 1.6.0 immediately to resolve the improper PocketBase configuration.
2. Implement strict network access controls (e.g., VPN or IP allowlisting) to restrict access to the /api/collections/ endpoint to authorized internal segments only.
3. Deploy the webserver-based Sigma rule provided in this brief to detect unauthorized API access patterns targeting the /api/collections/ endpoint.
4. Conduct an audit of existing CheckCle data for signs of unauthorized access or modification, focusing on records within alert_configurations and status_pages.