CVE-2024-42328

What it actually does

Null pointer dereference in the Zabbix Browser webdriver when curl_write_cb never populates the data buffer on an empty HTTP response, resulting in a crash on subsequent read of wd->data.

Why it matters to the business

Monitoring or automation workflows that use the Browser object can be terminated unexpectedly, causing loss of visibility into web-based targets and potential alert fatigue or missed incidents until the process is restarted.

How an attack unfolds

An attacker hosts an HTTP server that returns a zero-length response body, then causes the Zabbix Browser webdriver to request that URL; the missing allocation leaves the data pointer NULL and triggers a crash on access.

How to fix it

Update zabbix/zabbix (GIT) to commit f383737f1083e25756c6afaaa8abff05ad11eb50 or later; rebuild and redeploy the affected components that contain the Browser webdriver.

How to confirm the fix worked

Confirm the running binary or source tree contains commit f383737f1083e25756c6afaaa8abff05ad11eb50; trigger a Browser fetch against an empty HTTP response and verify the process no longer crashes.

Typical attack path

1. Attacker controls or compromises an HTTP endpoint that returns an empty document
2. Zabbix Browser object is instructed to load that URL via webdriver
3. curl_write_cb is never invoked or receives no data, leaving wd->data as NULL
4. Subsequent code dereferences the NULL pointer and the process crashes

How to detect it

Review Zabbix server, proxy, and agent logs for segmentation faults or crashes originating from the Browser webdriver code path; correlate with HTTP requests that returned empty bodies around the time of the crash.

What your security team should do

• Apply the referenced commit immediately in all development, test, and production Zabbix instances that use the Browser object
• Add regression tests that exercise Browser fetches against zero-length responses
• Monitor process crash and restart rates for the Zabbix server or proxy components until patches are deployed