CVE-2023-32727

What it actually does

Allows an authenticated user with item configuration privileges to inject and execute arbitrary commands on the Zabbix server by embedding malicious payloads in the icmpping() function parameters.

Why it matters to the business

Enables remote code execution on the monitoring server, potentially leading to full compromise of the Zabbix infrastructure and sensitive monitoring data across Debian and Ubuntu Linux environments.

How an attack unfolds

An attacker with sufficient privileges configures a Zabbix item using icmpping() and inserts shell commands that get executed on the server.

How to fix it

Upgrade affected packages to the listed fixed versions including linux (Debian:11): fixed in 5.10.84-1, linux (Debian:12): fixed in 5.14.12-1, linux (Debian:13): fixed in 5.14.12-1, and corresponding Ubuntu kernel packages such as linux-aws-5.15 (Ubuntu:20.04:LTS): fixed in 5.15.0-1014.18~20.04.1.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases and test that icmpping() item configuration no longer permits command injection.

Typical attack path

1. Obtain privileges to configure Zabbix items
2. Create or modify an item using icmpping() with malicious command
3. Trigger the item check to execute the payload on the server

How to detect it

Review Zabbix server logs and item configuration history for suspicious icmpping() entries containing shell metacharacters or unexpected commands.

What your security team should do

• Apply the specified package updates immediately given the 1033 days since publication
• Audit Zabbix item configurations for unauthorized changes
• Restrict item configuration privileges to trusted administrators only