Improper Authentication in Zabbix - CVE-2022-23131
Published: February 23, 2022 / Updated: September 20, 2024
Vulnerability identifier: #VU60811
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-23131
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to bypass SAML authentication process.
The vulnerability exists due to unsafe usage of session data stored in local storage when using SAML SSO authentication. A remote attacker with knowledge of a valid username can bypass SAML SSO authentication and gain administrative access to Zabbix Frontend.
Successful exploitation of the vulnerability requires that the SAML SSO authentication is enabled (disabled by default).
Affected software
Zabbix
Fedora
zabbix40
zabbix50
Fedora
zabbix40
zabbix50
How to mitigate CVE-2022-23131
Install updates from vendor's website.
Zabbix - update to 5.4.9 rc2
zabbix40 - update to 4.0.37-1.el7
zabbix50 - update to 5.0.19-1.el7
zabbix40 - update to 4.0.37-1.el7
zabbix50 - update to 5.0.19-1.el7
Links to Public Exploits and PoC-codes
- Exploit #10517 - CVE-2022-23131 (CVE-2022-23131 Zabbix Server SAML authentication exploit) (September 20, 2024)
- Exploit #8897 - CVE-2022-23131 (cve-2022-23131 exp) (March 9, 2023)
- Exploit #8304 - CVE-2022-23131poc-exp-zabbix- (CVE-2022-23131漏洞批量检测与利用脚本) (August 28, 2022)
- Exploit #8173 - CVE-2022-23131poc-exp-zabbix- (CVE-2022-23131漏洞批量检测与利用脚本) (July 24, 2022)
- Exploit #7862 - CVE-2022-23131 () (May 19, 2022)
- Exploit #7599 - CVE-2020-23131 (CVE-2022-23131漏洞利用工具开箱即用。) (April 5, 2022)
- Exploit #7585 - CVE-2022-23131 (CVE-2022-23131漏洞利用工具开箱即用。) (April 3, 2022)
- Exploit #7400 - CVE-2022-23131 (Zabbix - SAML SSO Authentication Bypass) (February 28, 2022)
- Exploit #7396 - zabbix-cve-2022-23131 () (February 27, 2022)
- Exploit #7391 - CVE-2022-23131 () (February 25, 2022)
- Exploit #7390 - CVE-2022-23131 () (February 25, 2022)
- Exploit #7388 - cve-2022-23131-exp (Zabbix SSO Bypass) (February 24, 2022)
- Exploit #7380 - cve-2022-23131 (poc) (February 23, 2022)
- Exploit #7379 - CVE-2022-23131 () (February 23, 2022)
- Exploit #7378 - zabbix-saml-bypass-exp (cve-2022-23131 exp) (February 23, 2022)
- Exploit #7377 - cve-2022-23131 (cve-2022-23131) (February 23, 2022)
- Exploit #7376 - cve-2022-23131 (cve-2022-23131 zabbix-saml-bypass-exp) (February 23, 2022)