CVE-2024-36463

What it actually does

The atob implementation in Zabbix JS permits construction of arbitrary string content that can be used to reference and read internal object properties, resulting in unauthorized information disclosure.

Why it matters to the business

Attackers may obtain sensitive internal data from Zabbix deployments, increasing risk of further compromise or data leakage in monitoring environments; low exploit maturity and absence from known exploited lists reduce immediate urgency but patching remains necessary for exposed instances.

How an attack unfolds

An attacker supplies crafted input to a Zabbix JS execution context that invokes atob to generate a string referencing internal object properties, allowing direct access to otherwise protected data without authentication bypass or code execution.

How to fix it

Update Zabbix to the fixed commit d93ce022627d3f10608b774e322cde3c961453e3 or later; disable unnecessary JS preprocessing where feasible until upgrade is complete.

How to confirm the fix worked

Confirm the deployed Zabbix version includes commit d93ce022627d3f10608b774e322cde3c961453e3; test atob behavior with crafted inputs to verify internal properties are no longer accessible.

Typical attack path

1. Identify a Zabbix component that processes user-controlled input through JS preprocessing or scripting
2. Craft input containing atob calls that produce strings targeting internal object property paths
3. Submit the input to trigger the vulnerable atob implementation and retrieve disclosed internal data
4. Use obtained information to map further attack surface or exfiltrate configuration details

How to detect it

Search Zabbix server and agent logs for unusual atob usage patterns or unexpected property access attempts in JS preprocessing contexts; review audit logs for anomalous data retrieval from internal objects.

What your security team should do

• Prioritize upgrade of all Zabbix instances to the fixed commit within standard change windows
• Review and restrict JS preprocessing usage to only trusted scripts
• Monitor EPSS trend for any increase indicating rising exploit interest