CVE-2022-23132: Zabbix Auth Bypass Vulnerability

CVE-2022-23132 Overview

CVE-2022-23132 is an improper access control vulnerability affecting Zabbix installations deployed from RPM packages. During the installation process, the DAC_OVERRIDE SELinux capability is utilized to access PID files in the /var/run/zabbix folder. This configuration flaw allows Zabbix Proxy or Server processes to bypass file read, write, and execute permission checks at the file system level, potentially enabling unauthorized access to sensitive system resources.

Critical Impact

Zabbix Server and Proxy processes can bypass file system permission checks, potentially allowing unauthorized file operations and compromising system integrity on affected monitoring infrastructure.

Affected Products

• Zabbix Zabbix (multiple versions through 6.0.0 alpha releases)
• Fedora 34
• Fedora 35

Discovery Timeline

• 2022-01-13 - CVE CVE-2022-23132 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2022-23132

Vulnerability Analysis

This vulnerability stems from an overly permissive SELinux policy configuration applied during RPM-based Zabbix installations. The DAC_OVERRIDE capability is a powerful Linux kernel capability that allows processes to bypass discretionary access control (DAC) permission checks for read, write, and execute operations on files. When granted to Zabbix processes, this capability effectively nullifies standard Unix file permissions, allowing the Zabbix Server or Proxy to access any file on the system regardless of ownership or permission settings.

The vulnerability is classified under CWE-284 (Improper Access Control) and CWE-732 (Incorrect Permission Assignment for Critical Resource), reflecting the fundamental misconfiguration in how SELinux capabilities are assigned to Zabbix service processes. In environments where Zabbix is compromised or where multi-tenant isolation is required, this excessive privilege could be leveraged to read sensitive configuration files, modify system resources, or execute unauthorized operations.

Root Cause

The root cause of CVE-2022-23132 lies in the SELinux policy definitions included with the Zabbix RPM packages. Instead of implementing a principle of least privilege approach where Zabbix processes only receive the specific permissions needed to access their designated PID files in /var/run/zabbix, the installation grants the broad DAC_OVERRIDE capability. This capability was likely added as a convenience measure to ensure Zabbix processes could reliably access their PID files without encountering permission errors, but it inadvertently grants far more access than required for legitimate operations.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity and requires no authentication or user interaction. An attacker who can compromise the Zabbix Server or Proxy service—through other vulnerabilities, misconfigurations, or credential theft—could leverage the DAC_OVERRIDE capability to escalate their access beyond what normal file system permissions would allow.

Potential exploitation scenarios include:

• Reading sensitive configuration files containing credentials for monitored systems
• Modifying system files to establish persistence or disable security controls
• Accessing log files or data stores belonging to other applications on the same server
• Bypassing file-based access controls intended to isolate different services or tenants

Detection Methods for CVE-2022-23132

Indicators of Compromise

• Unexpected file access patterns from Zabbix processes outside of standard operational directories
• Zabbix processes reading or writing to sensitive system files such as /etc/shadow, /etc/passwd, or SSH key directories
• Anomalous capability usage detected in audit logs showing DAC_OVERRIDE being exercised against protected files
• Modification timestamps on critical system files correlating with Zabbix process activity

Detection Strategies

• Enable Linux audit framework rules to monitor capability usage by Zabbix processes using auditctl -a always,exit -F arch=b64 -S open -F euid=zabbix -k zabbix_file_access
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Review SELinux denial logs for any unexpected access attempts that might indicate capability misuse
• Monitor process capabilities using tools like getpcaps to verify Zabbix processes are not operating with excessive privileges

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions to monitor file system access patterns from service accounts
• Establish baseline behavior for Zabbix processes and alert on deviations in file access patterns
• Regularly audit SELinux policies and Linux capabilities assigned to service processes
• Implement centralized logging for file access events from Zabbix server hosts

How to Mitigate CVE-2022-23132

Immediate Actions Required

• Upgrade Zabbix to a patched version that does not require DAC_OVERRIDE capability for normal operations
• Review and audit current SELinux policies for Zabbix processes to understand the scope of granted capabilities
• Implement network segmentation to limit exposure of Zabbix servers to trusted networks only
• Consider deploying Zabbix in containerized environments with restricted capability sets

Patch Information

Zabbix has addressed this vulnerability through updates to their RPM packaging. Administrators should consult the Zabbix Support Issue ZBX-20341 for specific patch information and updated packages. Additionally, distribution-specific updates are available through Fedora Package Announcements and the Debian LTS Security Announcement.

Workarounds

• Manually remove the DAC_OVERRIDE capability from Zabbix SELinux policies if upgrading is not immediately possible
• Configure proper ownership and permissions on /var/run/zabbix to allow Zabbix user access without requiring elevated capabilities
• Use custom SELinux policies that grant only the minimum necessary file contexts for Zabbix operations
• Consider alternative installation methods (source compilation, containerization) that do not include the problematic capability configuration

# Verify Zabbix process capabilities
getpcaps $(pgrep zabbix_server)

# Check SELinux context of Zabbix processes
ps -eZ | grep zabbix

# Audit Zabbix file access with auditd
auditctl -w /var/run/zabbix -p rwxa -k zabbix_pid_access