CVE-2024-22117

What it actually does

The vulnerability allows manipulation of the sequential sysmapelementurlid assignment logic during URL insertion into map elements; an attacker can force an ID collision by manually supplying sysmapelementurlid + 1, causing subsequent legitimate inserts to fail because the application always reads the current maximum ID before incrementing.

Why it matters to the business

Teams lose the ability to collaboratively maintain network maps and linked URLs inside Zabbix, which can delay monitoring configuration changes and increase operational friction for organizations relying on dynamic map elements.

How an attack unfolds

An authenticated user with map-editing rights obtains the current highest sysmapelementurlid from the database, then submits a new URL while supplying a fabricated higher value; the application stores the supplied ID, so every later attempt by any user to add another URL reads the inflated ID and the next increment is already taken, blocking further additions.

How to fix it

Upgrade Zabbix to the commit f383737f1083e25756c6afaaa8abff05ad11eb50 or later; the fix replaces the read-increment-store pattern with an atomic database sequence or transaction-guarded insert that eliminates the manual-ID bypass.

How to confirm the fix worked

After upgrade, confirm that concurrent URL additions to the same map element succeed without manual ID manipulation and that the database no longer permits direct insertion of an arbitrary sysmapelementurlid that skips future legitimate increments.

Typical attack path

1. Obtain map edit permissions in Zabbix
2. Query the current maximum sysmapelementurlid for the target map element
3. Submit a new URL record while supplying sysmapelementurlid + 1
4. Observe that subsequent URL additions by any user fail with duplicate-key or constraint errors

How to detect it

Search application and database logs for insert attempts into the sysmapelementurl table that contain manually supplied sysmapelementurlid values; look for sequences of failed inserts due to duplicate key violations immediately after a single record with an out-of-sequence ID appears.

What your security team should do

• Apply the fixed commit immediately on all Zabbix instances that allow map editing
• Restrict map-editing privileges to the smallest possible set of trusted accounts
• Monitor database audit logs for unexpected sysmapelementurlid values that exceed normal sequential growth
• Test map-element URL insertion under concurrent load after patching to verify atomic behavior