CVE-2024-36461

What it actually does

The vulnerability allows authenticated users to directly modify memory pointers within the embedded JavaScript engine, resulting in memory corruption that can lead to arbitrary code execution or denial of service.

Why it matters to the business

Attackers could exploit this to disrupt monitoring systems or gain unauthorized access, potentially affecting operational visibility and security monitoring across the organization.

How an attack unfolds

An attacker with low-privileged access to the Zabbix interface crafts malicious JavaScript that manipulates memory pointers, leading to corruption that can be leveraged for further exploitation.

How to fix it

Upgrade affected packages to the fixed versions, such as libpcap-devel to 14:1.9.1-4.el8 on AlmaLinux 8, and apply any Zabbix-specific patches addressing the JavaScript engine memory handling.

How to confirm the fix worked

Verify installed package versions match the fixed releases and confirm that JavaScript execution no longer permits direct pointer modification through targeted testing.

Typical attack path

1. Gain access to a Zabbix user account with JavaScript execution privileges
2. Inject specially crafted JavaScript code to modify memory pointers
3. Trigger the code execution to corrupt memory
4. Leverage the corruption for code execution or system compromise

How to detect it

Review Zabbix server and JavaScript execution logs for unexpected memory errors, pointer manipulation attempts, or anomalous script behavior.

What your security team should do

• Apply the listed fixed package versions immediately on all affected systems
• Restrict JavaScript execution privileges to the minimum required users
• Monitor Zabbix logs for memory corruption indicators until patches are deployed