CVE-2022-23131 PoC — Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configure

Source

https://github.com/Kazaf6s/CVE-2022-23131

Associated Vulnerability

Title:Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML (CVE-2022-23131)
Description:In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).

Description

CVE-2022-23131漏洞利用工具开箱即用。

Readme

# CVE-2022-23131

CVE-2022-23131(Unsafe Session Storage)

#### 0x00 前言

zabbix的漏洞（CVE-2022-23131），偶然间拿到了国外某公司zabbix服务器。Zabbix Sia Zabbix是拉脱维亚Zabbix SIA（Zabbix Sia）公司的一套开源的监控系统。该系统支持网络监控、服务器监控、云监控和应用监控等。Zabbix Frontend 存在安全漏洞，该漏洞源于在启用 SAML SSO 身份验证（非默认）的情况下，恶意行为者可以修改会话数据，因为存储在会话中的用户登录未经过验证。 未经身份验证的恶意攻击者可能会利用此问题来提升权限并获得对 Zabbix 前端的管理员访问权限。

#### 0x02 漏洞影响

5.4.8

5.0.18

4.0.36

#### 0x03 使用方法

![image](https://user-images.githubusercontent.com/49508660/161397518-63493cad-8304-424d-98da-b76640e63009.png)

File Snapshot


 [4.0K]  /data/pocs/9fbf44471b2902e1c32d104372a1f2697f0e943e
├── [1.8K]  CVE-2022-23131.py
└── [ 887]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!