Remote Code Execution Vulnerability in Zabbix Agent 2: Smart Disk Command Injection
Summary
DEBIAN-CVE-2023-32728: The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution. Affects zabbix versions < 1:6.0.24+dfsg-1. Fixed in 1:6.0.24+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Zabbix is an open-source monitoring software tool for networks and applications. It provides real-time monitoring, alerting, and visualization of system performance metrics. The Zabbix Agent 2 is a component that collects and sends data to the Zabbix server. However, a vulnerability has been identified in the smart.disk.get item key, which fails to properly sanitize input parameters, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the Zabbix Agent 2's smart.disk.get item key, which does not adequately sanitize its parameters before executing them in a shell command. This oversight can allow an attacker to inject malicious commands, potentially leading to remote code execution. The implications of this vulnerability are severe, as it could enable unauthorized access to the system, data breaches, and further exploitation of the network.
How To Fix
Minimum fixed version
1:6.0.24+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade zabbixTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Zabbix Agent 2 or disable the smart.disk.get item key until the package is updated. This can be done by modifying the Zabbix configuration file to prevent the execution of potentially harmful commands.
Conclusion
The identified vulnerability in Zabbix Agent 2 poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to the latest patched version to safeguard their systems. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for zabbix →
FAQ
The vulnerability is a command injection flaw in the smart.disk.get item key of Zabbix Agent 2, which can lead to remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized access to the system, potential data breaches, and the ability for attackers to execute arbitrary commands.
Yes, a patched version of the Zabbix package is available. Users should update to version 1:6.0.24+dfsg-1 to mitigate the risk.
If immediate updates are not possible, consider restricting access to the Zabbix Agent 2 or disabling the vulnerable item key as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for zabbix.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
