Janis Nulle

The Perl SNMP trap receiver script `zabbix trap receiver.pl` fails to properly neutralize the ZBXTRAP record delimiter within trap content. This flaw allows an attacker capable of sending SNMP traps to inject records targeting other hosts, leading to a loss of data integrity.

The email media type OAuth form fails to validate the URL scheme of the Authorization endpoint value before passing it to the `window.open()` function. This allows the execution of a `javascript:` URL in the browser. An attacker can deliver a crafted media type configuration via an import file to execute arbitrary JavaScript in the context of the Super Admin who grants consent. This is a Stored Cross-Site Scripting (XSS) issue, where a malicious script is permanently stored on the server and executed when a user views the affected page.

An authenticated administrator without super-user privileges can inject a JavaScript payload when creating a maintenance period. This payload is executed when any user opens the tooltip for that specific maintenance period within the Host navigator widget, potentially allowing the attacker to perform unauthorized actions based on the permissions of the user who triggers the tooltip.

The Item history widget and the Plain text widget allow the execution of injected JavaScript when HTML display is enabled. This occurs when malicious JavaScript is sent from a monitored host controlled by an attacker. If a user opens a dashboard containing these widgets, the script executes, potentially allowing the attacker to perform unauthorized actions. The Item history widget replaced the Plain text widget starting with version 7.0.

A Zabbix user with API access can exploit a blind SQL injection in the `CApiService.php` file. The issue resides in the `sortfield` parameter, allowing an attacker to execute arbitrary SQL selects. While query results are not directly returned, data can be exfiltrated using time-based techniques. This could lead to the disclosure of session identifiers and compromise of administrator accounts. The vulnerable component is located at the API endpoint include/classes/api/`CApiService.php`. The vulnerable parameter is `sortfield`.

An unauthenticated attacker can exploit the 'validate' action in the Frontend to blindly instantiate arbitrary PHP classes. The impact of this issue depends on the environment setup and currently appears limited.

The Docker plugin in Zabbix Agent 2 fails to properly sanitize parameters for the 'docker.container info' function when forwarding them to the Docker daemon. This allows an attacker with the ability to invoke Agent 2 to read arbitrary files from running Docker containers by injecting them through the Docker archive API.

Name of the Vulnerable Software and Affected Versions: Zabbix Agent 2 versions 5.0 and earlier Description: The Zabbix Agent 2 smartctl plugin does not properly sanitize `smart.disk.get` parameters, potentially allowing an attacker to inject unexpected arguments into the `smartctl` command. This can lead to remote code execution. Recommendations: Update Zabbix Agent 2 to a version later than 5.0.

Name of the Vulnerable Software and Affected Versions: Zabbix (affected versions not specified) Description: A flaw exists in the Zabbix API where the `hostprototype.get` method inappropriately lists all host prototypes to users lacking assigned user groups. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.