Kelsier

A user capable of connecting to Agent 2 can inject an Oracle TNS connection string through the 'service' parameter. This allows the software to connect to a server controlled by an attacker, potentially leaking Oracle database credentials if they are stored in a named session.

The Docker plugin in Zabbix Agent 2 fails to properly sanitize parameters for the 'docker.container info' function when forwarding them to the Docker daemon. This allows an attacker with the ability to invoke Agent 2 to read arbitrary files from running Docker containers by injecting them through the Docker archive API.

Name of the Vulnerable Software and Affected Versions: Zabbix Agent 2 (affected versions not specified) Description: The Zabbix Agent 2 smartctl plugin does not properly sanitize `smart.disk.get` parameters, which allows an attacker to inject unexpected arguments into the `smartctl` command. This can be used to leak the NTLMv2 hash from a Windows system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.