CVE-2023-32728

What it actually does

The Zabbix Agent 2 smart.disk.get item key fails to sanitize user-supplied parameters before invoking an underlying shell command, enabling injection of arbitrary commands that execute with the privileges of the agent process.

Why it matters to the business

Attackers can gain remote code execution on monitored Linux systems, potentially leading to full host compromise, data exfiltration, or lateral movement in environments relying on Zabbix for infrastructure monitoring; the issue has been public for over 1000 days with low observed exploitation rates.

How an attack unfolds

An attacker with network access to a Zabbix Agent 2 instance crafts a malicious smart.disk.get item key containing shell metacharacters or command separators, submits it via the Zabbix protocol or a compromised Zabbix server, and the agent executes the injected payload without validation.

How to fix it

Upgrade Zabbix Agent 2 to a fixed version; on Debian 11/12/13 apply packages at least 5.10.84-1 or 5.14.16-1, and on Ubuntu 20.04/22.04 LTS apply the corresponding 5.15.0 or 6.5.0 kernel-related packages listed in the fixed_versions for each flavor.

How to confirm the fix worked

Verify the installed Zabbix Agent 2 package version against the fixed versions for the specific distribution and release; test that crafted smart.disk.get parameters no longer result in command execution by reviewing agent logs and process behavior.

Typical attack path

1. Identify exposed Zabbix Agent 2 instances via network scanning or reconnaissance
2. Craft and send a malicious smart.disk.get item key containing command injection payload
3. Trigger item collection through Zabbix server or direct agent communication
4. Execute arbitrary commands on the target host
5. Establish persistence or perform further actions such as credential theft or lateral movement

How to detect it

Search Zabbix agent logs and system process execution logs for invocations of smart.disk.get containing unexpected characters such as semicolons, pipes, or backticks; correlate with network connections to the agent port and any resulting shell processes.

• smart.disk.get.*[;&|`$]
• zabbix_agent2.*smart.disk.get

What your security team should do

• Prioritize patching Zabbix Agent 2 instances on internet-facing or high-value hosts within standard change windows given the public disclosure age and low EPSS
• Restrict network access to Zabbix agents using firewall rules or VPNs to reduce exposure
• Audit Zabbix item configurations for use of smart.disk.get and replace with safer alternatives where possible
• Enable and review Zabbix agent logging for unusual item key activity