CVE-2024-22121

What it actually does

A local non-admin user can modify or remove key features of the Zabbix Agent due to missing authorization checks, allowing unauthorized changes that affect integrity and availability.

Why it matters to the business

Disrupted monitoring and data collection can create operational blind spots, increase incident response time, and require unplanned remediation across monitored environments.

How an attack unfolds

An attacker obtains a local non-admin account on a system running the affected agent, then uses the insufficient authorization controls to alter or disable important agent features.

How to fix it

Upgrade nodejs-nodemon to 1.18.3-1.module_el8.3.0+2023+d2377ea3 and nodejs-packaging to 17-3.module_el8.4.0+2224+b07ac28e on AlmaLinux 8 systems; apply vendor patches for the Zabbix Agent as they become available and restrict local access where possible.

How to confirm the fix worked

Confirm package versions match the fixed releases, review agent configuration permissions, and test that non-admin accounts can no longer alter protected features.

Typical attack path

1. Obtain local non-admin access on the target host
2. Locate the Zabbix Agent installation and configuration
3. Issue unauthorized modification commands against agent features
4. Verify or trigger integrity or availability impact

How to detect it

Review system and application logs for unauthorized configuration changes or feature modifications performed by non-admin accounts; examine agent logs and process activity around the time of suspected tampering.

What your security team should do

• Prioritize patching the listed packages on all AlmaLinux 8 instances
• Audit local user permissions on systems running the agent
• Monitor for post-patch configuration drift or unauthorized feature changes