Zabbix Agent and Agent 2 DLL Injection Vulnerability via OpenSSL Configuration on Windows

A vulnerability exists in Zabbix Agent and Agent 2 for Windows, where the OpenSSL configuration file is loaded from a user-writable path. This flaw allows low-privileged users to maliciously alter the configuration, potentially leading to local privilege escalation by injecting a DLL. The issue arises because the modified configuration file is only loaded after restarting Zabbix Agent or the system.

Impact

Exploitation of this vulnerability could result in unauthorized DLL injection, allowing for local privilege escalation on the affected Windows system.

Reproduction

A local Windows user with Zabbix Agent or Zabbix Agent 2 installed can modify the OpenSSL configuration file. The injected DLL will be executed the next time Zabbix Agent is started or the system is rebooted.

Remediation

Users can update to Zabbix Agent version 6.0.41, 7.0.18, 7.2.12, or 7.4.2 to address this vulnerability.