CVE-2024-36464

What it actually does

Media type export functionality serializes authentication credentials directly into the generated YAML without encryption or redaction, exposing plaintext passwords to any user permitted to perform the export operation.

Why it matters to the business

Exported configuration files may contain readable passwords that could be viewed by anyone who receives or accesses the file, increasing the chance of credential leakage if files are stored, emailed, or backed up insecurely, though the risk is limited to users already authorized for media type access.

How an attack unfolds

An attacker who already possesses sufficient permissions to export media types triggers the export, receives the YAML file containing the passwords in clear text, and can then read or store those credentials; because the attacker must already have the required export rights, this does not provide new access beyond what the permissions already allow.

How to fix it

Upgrade Zabbix to a build containing commit 680df722d6b72279a2fca65717fa113bfa9c48bc or later; after upgrade, re-export media types and verify that passwords no longer appear in plaintext within the YAML output.

How to confirm the fix worked

Perform a media type export after applying the fix and confirm that password fields are absent or redacted in the resulting YAML; review any previously exported files for the presence of plaintext credential values.

Typical attack path

1. Obtain or abuse an account with media type export permissions
2. Invoke the media type export feature
3. Receive and open the generated YAML file
4. Extract any plaintext passwords present in the file

How to detect it

Review exported YAML files or backup archives for the presence of media type password fields; examine user activity logs for export operations performed by accounts that should not require password visibility.

What your security team should do

• Apply the referenced commit or newer release to all Zabbix instances
• Audit and rotate any credentials that may have appeared in prior exports
• Restrict export permissions to the minimum necessary roles
• Add exported configuration files to data classification and handling policies