{"uuid": "23924510-c881-4e31-838a-1332c04091a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23134", "type": "seen", "source": "https://t.me/hacking_Attack/43621", "content": "Black Hat Ethical Hacking\nCritical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on serversPost Views: 208 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nTwo vulnerabilities in\u00a0open source\u00a0monitoring platform Zabbix could allow an attacker to bypass authentication and execute arbitrary code on a targeted server.\nThe security flaws were found in Zabbix Web Frontend, a platform used to collect, centralize. and track metrics such as CPU load and network traffic across entire infrastructures.\n\nResearchers from SonarSource, who discovered the bugs, noted that Zabbix is a high-profile target for threat actors due to its popularity, features, and its \u201cprivileged position in most company\u2019s networks\u201d. IssuesThe first vulnerability, tracked as CVE-2022-23131, which was given a severity of 9.1, is unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.\n\nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified.\n\nA malicious unauthenticated actor could exploit this issue to escalate privileges and gain admin access to the Zabbix Frontend.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nA caveat to this is that to perform the attack, SAML authentication is required to be enabled, and the assailant has to know the username of Zabbix user (or use the guest account, which is disabled by default), a security advisory\u00a0from Zabbix notes.\n\nThe second vulnerability found by SonarSource, tracked as CVE-2022-23134, is rated as medium severity and allows some steps of setup.php file to be reachable not only by super-administrators, but by unauthenticated users as well.\n\nA malicious actor could pass step checks and potentially change the configuration of Zabbix Frontend, an advisory notes.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Patch nowIn a blog post from SonarSource, the researchers said that when writing and reviewing code related to important security features, \u201cit is easy to make the same assumptions as the original developer who introduced the vulnerability\u201d.\n\nThey wrote: \u201cHere, there were no integration tests related to the client-side session storage that could have spotted this behavior.\n\n\u201cAlways provide access to sensible services with extended internal accesses (e.g. orchestration, monitoring) over VPNs or a restricted set of IP addresses, harden filesystem permissions to prevent unintended changes, remove setup scripts, etc.\u201d\n\nFinally, the researchers recommended upgrading all instances running a Zabbix Web Frontend to 6.0.0beta2, 5.4.9, 5.0.19, or 4.0.37. See Also: Offensive Security Tool: Swaks \u2013 Swiss Army Knife for SMTP\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: How ILOVEYOU worm became the first global computer virus pandemic Source: portswigger.net Source Linkhttps://www.blackh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:07.557473Z"}