Zabbix vulnerabilities

An authenticated administrator can crash Zabbix server or proxy by creating specially crafted preprocessing/script item JavaScript scripts, leading to denial of service.

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key, leading to potential loss of data integrity.

A Zabbix administrator can read out-of-bounds memory by exploiting a flaw in the HttpRequest logic of script items/preprocessing (JavaScript), leading to potential confidentiality loss.

An authenticated user can cause disproportionate CPU load on the Frontend webserver by sending specially crafted requests to the validate.api.exists action, leading to potential denial of service.

The frontend validate.api.exists action can be exploited by authenticated users to extract plaintext user macro values, leading to potential loss of confidentiality.

An unauthenticated user can cause disproportionate CPU load on the Frontend webserver by sending specially crafted requests to the popup.testtriggerexpr action, leading to potential denial of service.

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.

The login lockout mechanism in Zabbix API and Frontend has a flaw where several unsuccessful login requests sent simultaneously are not properly counted towards the block counter, potentially allowing more password guesses than intended.

A low-privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

Input validation for host and event action scripts in Zabbix uses regex (set by the administrator) but runs in multiline mode. If ^ and $ anchors are used, an injected newline lets authenticated users bypass the check and inject shell commands.

For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts in script items, JavaScript reprocessing, and Webhooks. This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released making built-in Zabbix JavaScript objects read-only, but usage of global JavaScript variables is not recommended.

Zabbix before 2.2.14 and 3.0 before 3.0.4 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.