CVE-2024-42330

What it actually does

The HttpRequest object returns HTTP header strings directly from server responses without proper JavaScript encoding, enabling creation of internal strings that access hidden object properties.

Why it matters to the business

Attackers may bypass access controls or manipulate internal object state in Zabbix monitoring deployments, potentially exposing sensitive configuration or operational data.

How an attack unfolds

An attacker positions a malicious or compromised HTTP server that returns crafted response headers; when Zabbix processes the response via HttpRequest, the unencoded strings allow access to normally inaccessible object properties.

How to fix it

Update zabbix/zabbix to commit f383737f1083e25756c6afaaa8abff05ad11eb50 or later release containing the fix.

How to confirm the fix worked

Confirm the deployed Zabbix source or binary contains commit f383737f1083e25756c6afaaa8abff05ad11eb50; test HttpRequest header handling with crafted responses to verify encoding is applied.

Typical attack path

1. Identify Zabbix components that issue HTTP requests via the affected HttpRequest object
2. Host or compromise a server that returns specially crafted HTTP response headers
3. Trigger the HttpRequest to fetch headers from the attacker-controlled response
4. Use resulting internal strings to access hidden object properties and escalate privileges or exfiltrate data

How to detect it

Inspect Zabbix application and web server logs for unexpected HTTP header values or requests to untrusted external hosts; look for post-exploitation indicators of object property manipulation in debug or audit logs.

What your security team should do

• Apply the fixed commit immediately in all Zabbix GIT-based deployments
• Review network egress rules for Zabbix components that perform HTTP requests
• Monitor for unusual object property access patterns in application logs