CVE-2024-22116

The script execution functionality in the Monitoring Hosts section does not apply default escaping of parameters passed to scripts. A logged-in administrator with limited privileges can modify the Ping script parameters in such a way as to inject and execute arbitrary system commands (command injection). The lack of input data sanitization allows passing a malicious payload, which is subsequently interpreted and executed by the system.

An attacker can execute arbitrary code on the Zabbix server, leading to complete system compromise — loss of confidentiality, integrity and availability of data and the entire monitored infrastructure.

Security patches provided by the vendor should be applied according to the references. Users of Debian distributions should check security updates announced on the debian-lts-announce mailing list (October 2024). It is also recommended to limit the number of accounts with administrative privileges to the minimum necessary.

Zabbix — versions indicated in vendor references (details: https://support.zabbix.com/browse/ZBX-25016)