Zabbix Agent 2 Smartctl Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Zabbix Agent 2 smartctl plugin, specifically in Zabbix version 5.0. The issue arises because the plugin fails to properly sanitize parameters for the 'smart.disk.get' command, allowing attackers to inject unexpected arguments that could be executed as code.

Impact

Exploitation of this vulnerability allows for remote code execution on the system where Zabbix Agent 2 is running.

Reproduction

To reproduce this vulnerability, an attacker can send a request to the Zabbix Agent 2 to monitor a metric using the 'smart.disk.get' item key. The request should include malicious arguments that take advantage of the plugin's lack of input validation, injecting unexpected commands to be executed.

Remediation

Users can update to Zabbix Agent 2 version 5.0.47 or later, where this vulnerability has been fixed. Alternatively, the smartctl plugin can be removed or configured to validate item key parameters more strictly.