Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
Vulnerability Description
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23131
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Zabbix wants to thank Thomas Chauchefoin from SonarSource for reporting this issue to us
References
More from Zabbix
View All →Affected Vendor
Zabbix
View all reports →