CVE-2022-23134: Zabbix Authentication Bypass Vulnerability

CVE-2022-23134 Overview

CVE-2022-23134 is an authentication bypass vulnerability affecting Zabbix Frontend, a popular open-source network monitoring solution. After the initial setup process completes, certain steps of the setup.php file remain accessible to unauthenticated users rather than being restricted to super-administrators only. This improper access control allows malicious actors to bypass step checks and potentially modify the configuration of Zabbix Frontend without authentication.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Unauthenticated attackers can modify Zabbix Frontend configuration, potentially leading to complete compromise of monitoring infrastructure.

Affected Products

• Zabbix Zabbix (multiple versions including 5.x and 6.0.0 alpha/beta releases)
• Fedora 34 and 35 (via packaged Zabbix)
• Debian Linux 9.0 (via packaged Zabbix)

Discovery Timeline

• 2022-01-13 - CVE-2022-23134 published to NVD
• 2025-10-30 - Last updated in NVD database

Technical Details for CVE-2022-23134

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) and improper authentication (CWE-287) within the Zabbix Frontend web application. The setup.php file, which is designed to handle initial Zabbix configuration, fails to properly enforce authentication checks after the setup process has been completed.

Under normal circumstances, the setup wizard should only be accessible during initial installation or by authenticated super-administrators for reconfiguration purposes. However, due to flawed step validation logic, unauthenticated users can directly access specific setup steps by manipulating request parameters, effectively bypassing the intended access restrictions.

The vulnerability allows attackers to reach configuration pages that should be protected, enabling them to modify database connection settings, change authentication parameters, or alter other critical configuration values that could lead to further system compromise.

Root Cause

The root cause lies in insufficient authorization checks within the setup.php file. The application fails to verify that users accessing setup steps are properly authenticated as super-administrators. The step-based navigation logic can be circumvented, allowing attackers to skip authentication requirements and directly access sensitive configuration functions.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker with network access to a Zabbix Frontend instance can:

1. Directly access the setup.php endpoint on the target Zabbix server
2. Manipulate step parameters to bypass sequential validation checks
3. Access configuration steps that should require super-administrator privileges
4. Modify Zabbix Frontend configuration settings, potentially pointing the application to an attacker-controlled database or altering security settings

The attack requires no special privileges and can be executed remotely against any exposed Zabbix Frontend installation running a vulnerable version.

Detection Methods for CVE-2022-23134

Indicators of Compromise

• Unexpected HTTP requests to /setup.php from external or unauthorized IP addresses
• Configuration changes in Zabbix without corresponding administrative activity logs
• Modified database connection settings or authentication parameters
• Anomalous access patterns targeting Zabbix setup endpoints outside of maintenance windows

Detection Strategies

• Monitor web server access logs for requests to setup.php that do not originate from administrative sessions
• Implement file integrity monitoring on Zabbix configuration files to detect unauthorized changes
• Configure alerts for any access to setup-related endpoints after initial deployment
• Deploy web application firewalls (WAF) with rules to block unauthenticated access to sensitive endpoints

Monitoring Recommendations

• Enable detailed logging for all Zabbix Frontend access, particularly to administrative and setup endpoints
• Implement network-level monitoring to detect scanning activity targeting Zabbix installations
• Configure SIEM rules to correlate Zabbix access logs with authentication events
• Regularly audit Zabbix configuration integrity against known-good baselines

How to Mitigate CVE-2022-23134

Immediate Actions Required

• Update Zabbix to the latest patched version immediately, as this vulnerability is actively exploited
• Restrict network access to Zabbix Frontend using firewall rules to limit exposure
• Remove or rename the setup.php file if the initial setup has been completed and reconfiguration is not needed
• Review Zabbix configuration for any unauthorized changes and restore from known-good backups if necessary

Patch Information

Zabbix has released security patches addressing this vulnerability. Administrators should consult the Zabbix Issue Tracking system for specific version information and upgrade instructions. Additionally, security updates are available through distribution package managers for Fedora (see Fedora Package Announcement) and Debian (see Debian LTS Announcement).

Workarounds

• Implement web server access controls to restrict setup.php to trusted IP addresses only
• Use .htaccess or equivalent web server configuration to require authentication for setup.php
• Place Zabbix Frontend behind a reverse proxy with additional authentication requirements
• Remove or rename setup.php after completing initial configuration

# Configuration example - Restrict access to setup.php in Apache
<Files "setup.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Files>

# Alternative: Rename setup.php to prevent unauthenticated access
mv /usr/share/zabbix/setup.php /usr/share/zabbix/setup.php.disabled