CVE-2017-2824 Command injection in Zabbix Server

What is CVE-2017-2824?

CVE-2017-2824 is a high-severity command injection vulnerability in Zabbix Zabbix, published on 24 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.

Weakness: CWE-78

Which versions are affected by CVE-2017-2824?

It affects 1 product.

Products include Zabbix Zabbix.

How do I fix CVE-2017-2824?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2017-2824 being exploited?

There is no known exploitation of CVE-2017-2824 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Zabbix Zabbix

• CVE-2022-23131 Zabbix Frontend Authentication Bypass Exploited Critical 9.1
• CVE-2007-0640 Memory corruption in n/a Critical 10.0
• CVE-2024-42327 SQL injection in user.get API Critical 9.9
• CVE-2024-22116 Remote code execution within ping script Critical 9.9
• CVE-2013-3738 Code injection in n/a Critical 9.8

All Zabbix Zabbix vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-2824, GHSA-wcgg-mr8m-q73v, UBUNTU-CVE-2017-2824.