CVE-2024-22123 Zabbix Arbitrary File Read
Attackers can read arbitrary files and corrupt logs by specifying malicious paths in SMS media GSM modem settings.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22123?
CVE-2024-22123 is a low-severity path traversal vulnerability in Zabbix Zabbix, published on 9 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.
Weakness: CWE-94
Which versions are affected by CVE-2024-22123?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2024-22123?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-22123 being exploited?
There is no known exploitation of CVE-2024-22123 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2024-22123, GHSA-qxrq-fp7f-qqh5, UBUNTU-CVE-2024-22123.