PT-2022-1636 · Zabbix+1 · Zabbix+1

Paalbra · Published 2021-08-20 · Updated 2024-12-10 · CVE-2021-46088

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zabbix versions 4.0 LTS through 5.0 LTS

Description The issue allows for Remote Code Execution (RCE) due to authorization errors. Any user with the Zabbix Admin role can run custom shell scripts on the application server in the context of the application user. This could potentially allow an attacker to execute arbitrary code with root privileges.

Recommendations For Zabbix versions 4.0 LTS, 4.2, 4.4, and 5.0 LTS, consider restricting the Zabbix Admin role to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling custom shell script execution on the application server until a fix is released. Restrict access to the application server to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ALT-PU-2021-2582

ALT-PU-2021-2668

ALT-PU-2023-6268

BDU:2022-00879

CVE-2021-46088

ROSA-SA-2024-2539

Affected Products

Alt Linux

Zabbix

References · 11

• 🔥 https://github.com/paalbra/zabbix-zbxsec-7 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46088 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00879 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46088 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46088 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-46088 · Security Note
• https://t.me/cibsecurity/36393 · Telegram Post
• https://abf.rosa.ru/advisories/ROSA-SA-2024-2539 · Note
• https://t.me/cvenotify/25925 · Telegram Post
• https://altsp.su/obnovleniya-bezopasnosti · Note