-
Type:
Defect (Security)
-
Resolution: Won't fix
-
Priority:
Critical
-
None
-
Affects Version/s: 4.4.0
-
Component/s: Frontend (F)
Steps to reproduce:
- Cf : https://www.exploit-db.com/exploits/47474
- Cf : https://blog.firosolutions.com/exploits/zabbix-auth-bypass/
- URL affected :
https://TARGET/zabbix/zabbix.php?action=dashboard.view
https://TARGET/zabbix/zabbix.php?action=dashboard.view&ddreset=1
https://TARGET/zabbix/zabbix.php?action=problem.view&ddreset=1
https://TARGET/zabbix/overview.php?ddreset=1
https://TARGET/zabbix/zabbix.php?action=web.view&ddreset=1
https://TARGET/zabbix/latest.php?ddreset=1
https://TARGET/zabbix/charts.php?ddreset=1
https://TARGET/zabbix/screens.php?ddreset=1
https://TARGET/zabbix/zabbix.php?action=map.view&ddreset=1
https://TARGET/zabbix/srv_status.php?ddreset=1
https://TARGET/zabbix/hostinventoriesoverview.php?ddreset=1
https://TARGET/zabbix/hostinventories.php?ddreset=1
https://TARGET/zabbix/report2.php?ddreset=1
https://TARGET/zabbix/toptriggers.php?ddreset=1
https://TARGET/zabbix/zabbix.php?action=dashboard.list
https://TARGET/zabbix/zabbix.php?action=dashboard.view&dashboardid=1
Content_Type => "application/x-www-form-urlencoded" seams not checked correctly.
Result:
By pass authentication on many url
Expected:
Logon page displayed.
- causes
-
ZBXNEXT-5532 Disable Guest user by default
-
- Closed
-
- is duplicated by
-
ZBX-16789 CVE-2019-17382 An attacker can bypass the login page and access the dashboard page ( CVSS: 9.1 Critical )
-
- Closed
-
- mentioned in
-
Page Loading...