CVE-2024-36460: Zabbix Information Disclosure Vulnerability

CVE-2024-36460 Overview

CVE-2024-36460 is a sensitive data exposure vulnerability in Zabbix, the popular open-source network monitoring solution. The front-end audit log functionality allows viewing of unprotected plaintext passwords, creating a significant security risk where credentials are displayed without any obfuscation or protection mechanisms.

Critical Impact
User credentials stored and displayed in plaintext within audit logs can be accessed by authenticated users with log viewing privileges, potentially leading to credential theft, unauthorized access to monitored systems, and lateral movement within the network infrastructure.

Affected Products

Zabbix versions prior to patched releases
Zabbix 7.0.0
Multiple Zabbix version branches as tracked in ZBX-25017

Discovery Timeline

2024-08-12 - CVE-2024-36460 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-36460

Vulnerability Analysis

This vulnerability falls under CWE-256 (Plaintext Storage of a Password) and CWE-522 (Insufficiently Protected Credentials). The core issue stems from Zabbix's audit logging mechanism recording sensitive credential information without applying any form of masking, hashing, or encryption before storage and display.

When administrative actions involving credentials are performed in the Zabbix front-end, the audit log captures these events including the actual password values. Any user with permissions to view audit logs can subsequently access these plaintext credentials, violating the principle of least privilege and exposing sensitive authentication data.

The vulnerability is exploitable over the network and requires low privileges to execute. While authentication is required to access the audit log functionality, the exposure of plaintext passwords significantly amplifies the risk, as compromised credentials could provide access to critical infrastructure being monitored by Zabbix.

Root Cause

The root cause is improper handling of sensitive data within the audit logging subsystem. The application fails to implement credential masking or sanitization when logging administrative actions that involve password fields. Instead of replacing password values with placeholder text (such as asterisks) or omitting them entirely from log entries, the system stores and displays the actual credential values.

Attack Vector

An attacker with authenticated access to the Zabbix front-end who has permissions to view audit logs can exploit this vulnerability. The attack scenario involves:

Gaining legitimate or compromised access to a Zabbix account with audit log viewing privileges
Navigating to the audit log section of the Zabbix front-end
Reviewing log entries for actions that involved credential changes or configurations
Extracting plaintext passwords from the displayed log entries
Using harvested credentials to access monitored systems or escalate privileges

The vulnerability requires no user interaction beyond the attacker accessing the audit logs. Since the attack occurs over the network through the standard web interface, it can be executed remotely from any location with access to the Zabbix front-end.

Detection Methods for CVE-2024-36460

Indicators of Compromise

Unusual or excessive access to audit log pages by non-administrative users
Audit log queries filtering for password-related actions or user modification events
Evidence of credential reuse attacks targeting systems monitored by Zabbix
Anomalous authentication attempts using credentials that were recently changed within Zabbix

Detection Strategies

Monitor Zabbix front-end access logs for frequent requests to audit log endpoints
Implement alerting for bulk exports or extended viewing sessions of audit log data
Track authentication events across monitored infrastructure for credential misuse patterns
Deploy user behavior analytics to detect abnormal audit log access patterns

Monitoring Recommendations

Enable detailed logging for all audit log access events within Zabbix
Correlate Zabbix user activity with downstream authentication events on monitored systems
Implement session monitoring to detect prolonged audit log viewing sessions
Review access control lists for audit log viewing permissions regularly

How to Mitigate CVE-2024-36460

Immediate Actions Required

Upgrade Zabbix to the latest patched version as recommended by the vendor
Restrict audit log viewing permissions to only essential administrative personnel
Review existing audit logs and rotate any passwords that may have been exposed
Audit all accounts with audit log access to ensure they are legitimate and necessary

Patch Information

Zabbix has addressed this vulnerability in updated releases. Organizations should consult the Zabbix Issue Tracker Entry for specific version information and upgrade guidance. Debian users should also review the Debian LTS Announcement for distribution-specific patches.

After patching, organizations should rotate all credentials that may have been logged in plaintext prior to the update.

Workarounds

Implement strict role-based access control to limit audit log visibility to essential personnel only
Consider temporarily disabling audit logging for sensitive operations until patches can be applied
Deploy a web application firewall (WAF) to monitor and restrict access to audit log endpoints
Implement network segmentation to limit access to the Zabbix front-end from trusted networks only

bash

# Review and restrict Zabbix user permissions for audit log access
# Consult Zabbix documentation for your specific version
# Example: Review user groups with audit log access
zabbix_server -c /etc/zabbix/zabbix_server.conf -R config_cache_reload