CVE-2023-29453: Zabbix Zabbix-agent2 XSS Vulnerability

CVE-2023-29453 Overview

CVE-2023-29453 is a critical code injection vulnerability affecting Zabbix Agent2 that stems from improper handling of backticks (`) as JavaScript string delimiters in Go templates. The vulnerability allows attackers to inject arbitrary JavaScript code into Go templates by exploiting the ES6 template literal syntax. When a Go template action is placed within a JavaScript template literal, an attacker can manipulate the action's contents to terminate the literal prematurely, enabling the injection of malicious JavaScript code.

Critical Impact

This vulnerability enables arbitrary JavaScript code injection through Go template manipulation, potentially allowing attackers to execute malicious code in the context of affected Zabbix monitoring infrastructure.

Affected Products

• Zabbix Agent2 (multiple versions)
• Systems using Go templates with JavaScript template literals
• Monitoring infrastructure relying on vulnerable Zabbix Agent2 deployments

Discovery Timeline

• 2023-10-12 - CVE-2023-29453 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-29453

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Code Injection) and affects the Go template engine's handling of JavaScript ES6 template literals. The core issue lies in how templates process backtick characters, which serve as delimiters for JavaScript template literals introduced in ES6. Unlike traditional single or double quotes, backticks enable complex string interpolation and multi-line strings in JavaScript.

When a Go template action (e.g., {{.}}) is embedded within a JavaScript template literal, the template engine fails to properly escape backticks. This oversight allows an attacker to craft input that terminates the JavaScript template literal prematurely, effectively breaking out of the intended string context and injecting arbitrary JavaScript code.

The complexity of ES6 template literals—particularly their native support for string interpolation via ${expression} syntax—makes secure handling exceptionally difficult. The Go security team determined that there is no obviously safe way to allow Go template actions inside JavaScript template literals, leading to the decision to disallow this pattern entirely in the fix.

Root Cause

The root cause is the Go template engine's failure to recognize backticks as JavaScript string delimiters requiring proper escaping. Prior to the fix, the template parser did not treat backticks with the same security considerations applied to single and double quotes. This allowed user-controlled input within Go template actions to contain backticks that would be interpreted as JavaScript template literal terminators, creating an injection point for malicious code.

Attack Vector

The attack exploits network-accessible Zabbix Agent2 installations where user-controlled data flows into Go templates that are rendered within JavaScript contexts. An attacker can craft a malicious payload containing a backtick followed by arbitrary JavaScript code. When this payload is processed by a vulnerable template:

1. The attacker's input is placed within a Go template action inside a JavaScript template literal
2. The backtick in the attacker's input terminates the legitimate template literal
3. The subsequent attacker-controlled content is interpreted as JavaScript code
4. The injected code executes in the context of the affected application

The vulnerability requires no authentication or user interaction and can be exploited remotely over the network, making it particularly dangerous in exposed monitoring environments.

Detection Methods for CVE-2023-29453

Indicators of Compromise

• Unexpected backtick characters in log entries or template processing outputs
• JavaScript syntax errors in monitoring dashboards or agent communications
• Anomalous network traffic patterns from Zabbix Agent2 processes
• Unusual script execution or process spawning from monitoring infrastructure

Detection Strategies

• Monitor template processing logs for malformed or suspicious input containing backtick sequences
• Implement web application firewalls (WAF) rules to detect JavaScript injection patterns in Zabbix communications
• Review Zabbix Agent2 configurations for any custom templates that embed user input in JavaScript contexts
• Deploy runtime application self-protection (RASP) solutions to detect code injection attempts

Monitoring Recommendations

• Enable verbose logging on Zabbix Agent2 instances to capture template processing activities
• Set up alerts for template parsing errors, particularly those matching the new ErrorCode 12
• Monitor for the GODEBUG flag jstmpllitinterp=1 in environment variables, which re-enables vulnerable behavior
• Establish baseline behavior for Zabbix Agent2 processes and alert on deviations

How to Mitigate CVE-2023-29453

Immediate Actions Required

• Update Zabbix Agent2 to the latest patched version immediately
• Audit all custom templates for Go template actions within JavaScript template literals
• Remove or refactor any templates using the pattern var a = {{.}} within JavaScript contexts
• Ensure the GODEBUG flag jstmpllitinterp=1 is not set unless absolutely necessary and risks are understood

Patch Information

Zabbix has released patches addressing this vulnerability. Refer to the Zabbix Support Ticket ZBX-23388 for specific version information and patch details. The fix causes Template.Parse to return an error with ErrorCode 12 when it encounters templates with Go actions inside JavaScript template literals. This ErrorCode will be exported in Go 1.21.

Workarounds

• Avoid using Go template actions inside JavaScript template literals entirely
• If re-enabling legacy behavior is necessary, use GODEBUG=jstmpllitinterp=1 with extreme caution, understanding that backticks will be escaped but the overall pattern remains risky
• Implement strict input validation to reject any user input containing backtick characters before template processing
• Isolate Zabbix Agent2 instances from untrusted network segments to reduce attack surface

# Verify Zabbix Agent2 version and check for vulnerable configurations
zabbix_agent2 -V

# Ensure GODEBUG flag is not enabling vulnerable behavior
env | grep GODEBUG

# If jstmpllitinterp=1 is found, remove it from environment
unset GODEBUG