QID 376061

Date Published: 2022-02-23

QID 376061: Zabbix Authentication Bypass Vulnerability (ZBX-20350)

Zabbix is an open-source monitoring software tool to monitor IT infrastructures such as networks, servers, virtual machines and cloud services.

In instances where SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. This can lead to authentication bypass/instance takeover via Zabbix Frontend.

Affected Versions:
Zabbix 5.4.0 - 5.4.8
Zabbix 6.0.0alpha1

QID Detection Logic (Authenticated): This QID checks for vulnerable Zabbix version by running "zabbix_server --version" command.

Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as Medium - 5.1 severity.
    • Solution

    Vendor has released patch, for more information please refer to ZBX-20350

    Workaround:
    Disable SAML authentication if you can not update to latest version of Zabbix.

    Vendor References

    CVEs related to QID 376061

    CVE-2022-23131 | CVE-2022-23134 |
    Software Advisories
    Advisory ID Software Component Link
    ZBX-20350 URL Logo support.zabbix.com/browse/ZBX-20350
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].