Remote code execution within ping script

The impact of CVE-2024-22116 is severe. A successful exploit allows an attacker to gain complete control over the Zabbix server, potentially leading to data breaches, system compromise, and disruption of monitoring services. Attackers could leverage this RCE to install malware, steal sensitive data collected by Zabbix (including credentials and system metrics), or pivot to other systems within the network. The ability to execute arbitrary code bypasses standard security controls and represents a significant escalation of privileges. This vulnerability shares similarities with other script injection flaws where insufficient input validation allows for code execution.

Organizations heavily reliant on Zabbix for monitoring critical infrastructure are particularly at risk. This includes those with complex Zabbix configurations, custom scripts, or a large number of administrators with varying permission levels. Shared hosting environments utilizing Zabbix are also vulnerable, as a compromised account on one instance could potentially impact others.

• linux / server:

journalctl -u zabbix-server -g "Ping script execution"

• zabbix: Review Zabbix logs for unusual script execution attempts, particularly those originating from restricted user accounts. • generic web: Check Zabbix server access logs for requests to the Monitoring Hosts section with unusual parameters. • windows / supply-chain: While Zabbix primarily runs on Linux, if agents are deployed on Windows, monitor PowerShell execution logs for suspicious scripts related to Zabbix.

1. 2024-08-09Disclosure

   disclosure

1. Réservé2024-01-05
2. Publiée2024-08-09
3. Modifiée2025-11-03
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-22116 is to immediately upgrade to Zabbix version 7.0.1 or later. If upgrading is not immediately feasible, consider restricting access to the Monitoring Hosts section to only highly trusted administrators. Implement strict input validation and sanitization for all script parameters within Zabbix. While a WAF may offer some protection, it is not a substitute for patching. Monitor Zabbix logs for suspicious activity, particularly related to script execution, and consider implementing intrusion detection signatures to identify potential exploitation attempts. After upgrading, confirm the fix by attempting to execute a script with malicious code through the Monitoring Hosts section; it should be rejected.