CVE-2022-23134

LOWCISA KEVNuclei

Possible view of the setup pages by unauthenticated users if config file already exists

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-23134 has a selected CVSS score of 3.7 (low); EIP currently links 1 repository PoC and 1 Nuclei template. CISA lists CVE-2022-23134 in KEV.

Description

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Feb 22, 2022 · CISA
VulnCheck KEV
Listed · Feb 22, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 29, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Frontend

Browse Zabbix / Frontend
CISA, CVE List5.4.0 - 5.4.8affected
5.4.9 to < 5.4.9*unaffected

Proofs of concept

1

Repository PoCs

GitHubTheN00bBuilder/cve-2022-23134-poc-and-writeupRepository PoCby TheN00bBuilder1Not analyzed14 files

1.1 MiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMZabbix Setup Configuration Authentication BypassCVSS 5.3

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Zabbix setup configuration.

Remediation

Apply the latest security patches or updates provided by Zabbix to fix the authentication bypass vulnerability.

WeaknessesCWE-287CWE-284
Authorsbananabr
Template tagscvecve2022zabbixauth-bypasskevvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CPE: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:892542951
Shodan: http.title:"zabbix-server"
Shodan: cpe:"cpe:2.3:a:zabbix:zabbix"
FOFA: icon_hash=892542951
FOFA: app="zabbix-监控系统" && body="saml"
FOFA: title="zabbix-server"
Google: intitle:"zabbix-server"
https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage https://nvd.nist.gov/vuln/detail/CVE-2022-23134 https://support.zabbix.com/browse/ZBX-20384 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/ https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html

Source: ProjectDiscovery

References

8