Details
-
Incident report
-
Resolution: Duplicate
-
Minor
-
None
-
4.4.0alpha1
-
None
Description
Zabbix before 4.2 allows User Enumeration. It is possible to enumerate application username based on different server responses (Login name or password is incorrect, Account is blocked for N seconds, No permissions for system access) using the requests to login.
API Request
POST /zabbix/api_jsonrpc.php HTTP/1.1
Host: company
Content-Type: application/json-rpc
{
"jsonrpc": "2.0",
"method": "user.login",
"params": {
"user": "Admin",
"password": "zabbix"
},
"id": 1
}
Web Interface Request
POST /zabbix/index.php HTTP/1.1 Host: company Content-Type: application/x-www-form-urlencoded name=Admin&password=password&autologin=1&enter=Sign+in
Attachments
Issue Links
- duplicates
-
ZBX-5842 exploit to check for an existence of the user with specified username
-
- Closed
-