CVE-2024-42330

The HttpRequest object retrieves HTTP headers from the server response after sending a request. The returned strings are created directly from data received from the server without proper encoding for the JavaScript context (CWE-134 — format string). This makes it possible to create internal strings that can be used to gain access to hidden object properties. An attacker with administrative privileges can craft a server response containing malicious data in HTTP headers.

An attacker can gain access to hidden properties of JavaScript objects in the Zabbix context, which combined with the high privilege level resulting from the vulnerability scope (Scope: Changed, C/I/A: High) may lead to complete breach of system confidentiality, integrity, and availability.

Patches available from the vendor should be applied according to references (https://support.zabbix.com/browse/ZBX-25626). Users of Debian LTS distributions should apply updates described in the debian-lts-announce announcement from December 2024.

Zabbix products — versions indicated in vendor references (issue ZBX-25626); the vulnerability also affects Debian LTS packages according to the debian-lts-announce announcement.