PRP: Request CVE-2022-23131 Zabbix SAML Authentication Bypass vulnerability

[hh-hunter]

Hello.

I would like to start implementing a plugin to detect CVE-2022-23131
This vulnerability should be relatively new and has been patched.

• https://nvd.nist.gov/vuln/detail/CVE-2022-23131
• https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage

The vulnerability has been assigned a CVE ID (CVSS score >= 7.0) and the severity level of the vulnerability is HIGH or CRITICAL: CVSS score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

With SAML SSO authentication enabled (not the default), a malicious actor can modify session data because the user login stored in the session is not authenticated. An unauthenticated malicious attacker could use this issue to elevate privileges and gain administrator access to the Zabbix frontend. To execute the attack, SAML authentication needs to be enabled and the attacker must know the username of the Zabbix user (or use a guest account that is disabled by default). In an automated attack, a predefined account can be selected to perform the blast.

The vulnerability can be exploited remotely without authentication and user interaction.

For the firing range of this vulnerability, I can provide the vmx image

Please let me know if this is in scope to start with its development.

[maoning]

Hi @hh-hunter,

Since you have opened 2 detector requests about Zabbix, could you implement a tsunami fingerprint for Zabbix? The result of service finger printing would help us determine how relevant Zabbix vulnerabilities are.

[hh-hunter]

No problem~so do complete the detection first, or the tsunami fingerprint one first?

[hh-hunter]

@maoning @magl0 hi,In order for us to solve these problems as soon as possible, can you send me some replies as soon as possible?

[maoning]

The tsunami fingerprint first please.

[hh-hunter]

@maoning I've opened an issue about zabbix fingerprinting(#236 ), but it's not tagged with any categories yet.

[hh-hunter]

@tooryx Before, when I wanted to develop this plugin, I was advised to implement fingerprinting first. I have already implemented the fingerprinting and merged it into the main branch. Can we continue developing this issue?