CVE-2021-27927: Zabbix CSRF Vulnerability

CVE-2021-27927 Overview

CVE-2021-27927 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Zabbix, the popular open-source enterprise monitoring solution. The vulnerability exists in the CControllerAuthenticationUpdate controller, which explicitly disables CSRF protection by calling diableSIDValidation inside the init() method. This allows attackers to craft malicious requests that can be executed in the context of authenticated Zabbix users.

Critical Impact

An attacker can exploit this CSRF vulnerability to modify authentication settings in Zabbix without needing to know the target user's login credentials. The attacker only requires knowledge of the Zabbix URL and must trick a user with sufficient privileges into visiting a malicious page.

Affected Products

• Zabbix versions 4.0.x before 4.0.28rc1
• Zabbix versions 5.0.0alpha1 before 5.0.10rc1
• Zabbix versions 5.2.x before 5.2.6rc1
• Zabbix versions 5.4.0alpha1 before 5.4.0beta2

Discovery Timeline

• 2021-03-03 - CVE-2021-27927 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-27927

Vulnerability Analysis

The vulnerability stems from a deliberate disabling of CSRF protection in a sensitive authentication controller within the Zabbix web interface. The CControllerAuthenticationUpdate controller handles authentication settings modifications, which is a critical administrative function that should require robust protection against unauthorized state-changing requests.

When CSRF protection is disabled, the application cannot verify that requests to update authentication settings originate from legitimate user actions within the application. This creates an opportunity for attackers to forge requests that will be automatically authenticated by the victim's browser session.

The vulnerability is particularly dangerous because it targets authentication settings. A successful attack could allow an attacker to change how users authenticate to Zabbix, potentially enabling account takeover or persistent backdoor access to the monitoring infrastructure.

Root Cause

The root cause is the explicit call to diableSIDValidation within the init() method of the CControllerAuthenticationUpdate controller. SID (Session ID) validation is Zabbix's mechanism for CSRF protection, and by disabling it, the controller becomes vulnerable to forged requests from external sites.

This appears to be a design decision that bypassed security controls, possibly to simplify development or resolve functionality issues, but ultimately left a critical administrative function unprotected.

Attack Vector

The attack requires social engineering to lure an authenticated Zabbix administrator to a malicious website or to click a crafted link. The attack flow involves:

1. The attacker identifies a target Zabbix installation URL and contact information for users with administrative privileges
2. The attacker crafts a malicious HTML page containing a hidden form that submits to the vulnerable Zabbix endpoint
3. When a victim with sufficient Zabbix privileges visits the attacker's page, the form auto-submits
4. The victim's browser includes their Zabbix session cookies with the forged request
5. Zabbix processes the request as legitimate, modifying authentication settings according to the attacker's payload

The attacker does not need valid Zabbix credentials; they only need to know the target URL and convince a privileged user to visit their malicious page. This could be achieved through phishing emails, watering hole attacks, or embedding the malicious content in advertising networks.

Detection Methods for CVE-2021-27927

Indicators of Compromise

• Unexpected changes to Zabbix authentication settings without corresponding administrator activity
• Access logs showing authentication update requests originating from external referrer URLs
• Multiple rapid authentication configuration changes from the same user session
• Authentication setting changes occurring outside normal administrative windows

Detection Strategies

• Monitor Zabbix audit logs for changes to authentication configuration settings
• Implement web application firewall (WAF) rules to detect requests to authentication endpoints with external or missing referer headers
• Configure alerts for authentication method changes in Zabbix configuration
• Review server access logs for suspicious patterns targeting /zabbix.php with action parameters related to authentication

Monitoring Recommendations

• Enable comprehensive audit logging in Zabbix to track all configuration changes
• Set up alerting for any modifications to LDAP, SAML, or HTTP authentication settings
• Monitor for unusual administrative actions performed during non-business hours
• Implement network segmentation to restrict access to Zabbix administrative interfaces

How to Mitigate CVE-2021-27927

Immediate Actions Required

• Upgrade Zabbix to a patched version immediately: 4.0.28rc1 or later for 4.0.x, 5.0.10rc1 or later for 5.0.x, 5.2.6rc1 or later for 5.2.x, or 5.4.0beta2 or later for 5.4.x
• Restrict network access to the Zabbix web interface to trusted IP addresses only
• Review recent authentication configuration changes for signs of compromise
• Educate administrative users about phishing and social engineering risks

Patch Information

Zabbix has released patched versions that properly implement CSRF protection for the authentication update controller. Organizations should upgrade to the following minimum versions:

• Zabbix 4.0.x: Upgrade to 4.0.28rc1 or later
• Zabbix 5.0.x: Upgrade to 5.0.10rc1 or later
• Zabbix 5.2.x: Upgrade to 5.2.6rc1 or later
• Zabbix 5.4.x: Upgrade to 5.4.0beta2 or later

For detailed patch information, refer to the Zabbix Issue Tracker - ZBX-18942. Additional security guidance is available in the Debian LTS Security Announcement.

Workarounds

• Implement a Web Application Firewall (WAF) to validate referer headers on sensitive administrative endpoints
• Restrict access to the Zabbix web frontend to a management network or VPN-only access
• Disable external network access to Zabbix administrative functions until patching is complete
• Use browser extensions that enforce strict referer policies when accessing Zabbix

# Example: Restrict Zabbix admin access via Apache
<Location /zabbix.php>
    # Require authentication update requests to originate from same host
    SetEnvIf Referer "^https://your-zabbix-server\.example\.com" valid_referer
    <If "%{QUERY_STRING} =~ /action=authentication\.update/">
        Require env valid_referer
    </If>
</Location>