CVE-2023-32727 Code execution vulnerability in icmpping
An attacker with item configuration privileges can execute arbitrary code on the Zabbix server via the icmpping function.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-32727?
CVE-2023-32727 is a medium-severity command injection vulnerability in Zabbix, published on 18 Dec 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
Weakness: CWE-20
Which versions are affected by CVE-2023-32727?
It affects 1 product.
Linux distribution packages (5)
zabbix SUSE:Package Hub 15 SP4 | All versions | 4.0.50-bp154.2.9.1 |
zabbix SUSE:Package Hub 15 SP5 | All versions | 4.0.50-bp155.3.9.1 |
zabbix openSUSE:Leap 15.4 | All versions | 4.0.50-bp154.2.9.1 |
zabbix openSUSE:Leap 15.5 | All versions | 4.0.50-bp155.3.9.1 |
zabbix openSUSE:Tumbleweed | All versions | 6.0.25-1.1 |
Products include Zabbix Zabbix Server.
How do I fix CVE-2023-32727?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-32727 being exploited?
There is no known exploitation of CVE-2023-32727 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2023-32727, GHSA-8h32-vcmm-pcx8, UBUNTU-CVE-2023-32727, openSUSE-SU-2023:0418-1, openSUSE-SU-2023:0419-1, openSUSE-SU-2024:13535-1.