{"id":45459,"date":"2022-02-25T22:50:32","date_gmt":"2022-02-25T22:50:32","guid":{"rendered":"http:\/\/383f8e19-3d34-4dcd-aae1-911de644587a"},"modified":"2022-02-25T22:50:32","modified_gmt":"2022-02-25T22:50:32","slug":"zabbix-vulnerabilities-added-to-cisa-catalog","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/zabbix-vulnerabilities-added-to-cisa-catalog\/","title":{"rendered":"Zabbix vulnerabilities added to CISA catalog"},"content":{"rendered":"

Two Zabbix vulnerabilities have been added<\/a> to the US Cybersecurity Infrastructure and Security Agency’s catalog of known exploited vulnerabilities. <\/p>\n

Federal civilian agencies have until March 8 to patch CVE-2022-23131 and CVE-2022-23134 — a Zabbix Frontend authentication bypass vulnerability and a Zabbix Frontend improper access control vulnerability. Zabbix is a popular open-source monitoring platform. <\/p>\n

Patches for the issues were released in December<\/a>. Zabbix explained that in the case of instances “where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified.”<\/p>\n

“Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default),” Zabbix said. <\/p>\n

“To remediate this vulnerability, apply the updates listed in the ‘Fixed Version’ section to appropriate products or if an immediate update is not possible, follow the presented below workarounds.” <\/p>\n

Zabbix credited SonarSource’s Thomas Chauchefoin for discovering and reporting the issue. SonarSource released its own blog<\/a> on the vulnerabilities where Chauchefoin goes into detail about the intricacies of the issue. He discovered it in November and noted that the initial patch proposed by Zabbix was able to be bypassed. <\/p>\n

BluBracket’s Casey Bisson explained that Zabbix is broadly used by businesses of all sizes to monitor servers and network equipment everywhere from data centers to branch offices. <\/p>\n

“A vulnerability that allows attackers past the authentication controls could give those attackers access to extensive details about the infrastructure,” Bisson said. <\/p>\n

“The details in Zabbix could reveal a map of sensitive company networks and equipment deep in company networks, including potentially vulnerable versions of software on that equipment. That information might be used to target further electronic attacks, social engineering, and spear phishing.”<\/p>\n

\"screen-shot-2022-02-25-at-5-15-22-pm.png\"<\/span>