CVE-2022-23134: Zabbix Authentication Bypass Vulnerability

CVE-2022-23134 Overview

CVE-2022-23134 is an authentication bypass vulnerability affecting Zabbix Frontend, a popular open-source network monitoring solution. After the initial setup process completes, certain steps of the setup.php file remain accessible to unauthenticated users rather than being restricted to super-administrators only. This improper access control allows malicious actors to bypass step checks and potentially modify the configuration of Zabbix Frontend without authentication.

Critical Impact
This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Unauthenticated attackers can modify Zabbix Frontend configuration, potentially leading to complete compromise of monitoring infrastructure.

Affected Products

Zabbix Zabbix (multiple versions including 5.x and 6.0.0 alpha/beta releases)
Fedora 34 and 35 (via packaged Zabbix)
Debian Linux 9.0 (via packaged Zabbix)

Discovery Timeline

2022-01-13 - CVE-2022-23134 published to NVD
2025-10-30 - Last updated in NVD database

Technical Details for CVE-2022-23134

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) and improper authentication (CWE-287) within the Zabbix Frontend web application. The setup.php file, which is designed to handle initial Zabbix configuration, fails to properly enforce authentication checks after the setup process has been completed.

Under normal circumstances, the setup wizard should only be accessible during initial installation or by authenticated super-administrators for reconfiguration purposes. However, due to flawed step validation logic, unauthenticated users can directly access specific setup steps by manipulating request parameters, effectively bypassing the intended access restrictions.

The vulnerability allows attackers to reach configuration pages that should be protected, enabling them to modify database connection settings, change authentication parameters, or alter other critical configuration values that could lead to further system compromise.

Root Cause

The root cause lies in insufficient authorization checks within the setup.php file. The application fails to verify that users accessing setup steps are properly authenticated as super-administrators. The step-based navigation logic can be circumvented, allowing attackers to skip authentication requirements and directly access sensitive configuration functions.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker with network access to a Zabbix Frontend instance can:

Directly access the setup.php endpoint on the target Zabbix server
Manipulate step parameters to bypass sequential validation checks
Access configuration steps that should require super-administrator privileges
Modify Zabbix Frontend configuration settings, potentially pointing the application to an attacker-controlled database or altering security settings

The attack requires no special privileges and can be executed remotely against any exposed Zabbix Frontend installation running a vulnerable version.

Detection Methods for CVE-2022-23134

Indicators of Compromise

Unexpected HTTP requests to /setup.php from external or unauthorized IP addresses
Configuration changes in Zabbix without corresponding administrative activity logs
Modified database connection settings or authentication parameters
Anomalous access patterns targeting Zabbix setup endpoints outside of maintenance windows

Detection Strategies

Monitor web server access logs for requests to setup.php that do not originate from administrative sessions
Implement file integrity monitoring on Zabbix configuration files to detect unauthorized changes
Configure alerts for any access to setup-related endpoints after initial deployment
Deploy web application firewalls (WAF) with rules to block unauthenticated access to sensitive endpoints

Monitoring Recommendations

Enable detailed logging for all Zabbix Frontend access, particularly to administrative and setup endpoints
Implement network-level monitoring to detect scanning activity targeting Zabbix installations
Configure SIEM rules to correlate Zabbix access logs with authentication events
Regularly audit Zabbix configuration integrity against known-good baselines

How to Mitigate CVE-2022-23134

Immediate Actions Required

Update Zabbix to the latest patched version immediately, as this vulnerability is actively exploited
Restrict network access to Zabbix Frontend using firewall rules to limit exposure
Remove or rename the setup.php file if the initial setup has been completed and reconfiguration is not needed
Review Zabbix configuration for any unauthorized changes and restore from known-good backups if necessary

Patch Information

Zabbix has released security patches addressing this vulnerability. Administrators should consult the Zabbix Issue Tracking system for specific version information and upgrade instructions. Additionally, security updates are available through distribution package managers for Fedora (see Fedora Package Announcement) and Debian (see Debian LTS Announcement).

Workarounds

Implement web server access controls to restrict setup.php to trusted IP addresses only
Use .htaccess or equivalent web server configuration to require authentication for setup.php
Place Zabbix Frontend behind a reverse proxy with additional authentication requirements
Remove or rename setup.php after completing initial configuration

bash

# Configuration example - Restrict access to setup.php in Apache
<Files "setup.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Files>

# Alternative: Rename setup.php to prevent unauthenticated access
mv /usr/share/zabbix/setup.php /usr/share/zabbix/setup.php.disabled