CVE-2024-36466: Zabbix Authentication Bypass Vulnerability

CVE-2024-36466 Overview

CVE-2024-36466 is an authentication bypass vulnerability in Zabbix, an enterprise-grade open-source monitoring platform. A flaw in the session handling code allows an attacker to sign a forged zbx_session cookie. The forged cookie grants the attacker administrative access to the Zabbix frontend. The weakness maps to CWE-290: Authentication Bypass by Spoofing. Successful exploitation compromises the confidentiality, integrity, and availability of the monitoring platform and any credentials or infrastructure data it stores.

Critical Impact
An authenticated attacker with a low-privileged Zabbix account can forge a session cookie and elevate to administrator, gaining full control of the Zabbix server and monitored asset data.

Affected Products

Zabbix 5.0.x through 5.0.42
Zabbix 6.0.x through 6.0.30
Zabbix 7.0.0

Discovery Timeline

2024-11-28 - CVE-2024-36466 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36466

Vulnerability Analysis

The vulnerability resides in how the Zabbix frontend generates and validates the zbx_session cookie used to track authenticated sessions. The signing implementation contains a flaw that lets an attacker construct a cookie whose signature the server accepts as legitimate. Because the cookie also encodes the session's user identity and role, an attacker can craft a cookie asserting administrative privileges.

The attack is network-reachable and requires only low privileges to observe or generate a baseline session. Once forged, the cookie allows the attacker to interact with the Zabbix API and web interface as an administrator. Administrative access in Zabbix exposes stored credentials for monitored hosts, script execution on Zabbix agents, and configuration of alerting and discovery workflows.

Root Cause

The root cause is a defect in the cookie signing routine that fails to bind the signature to server-side secrets or session state in a tamper-resistant way. This weakens the authentication guarantee the cookie is supposed to provide. Refer to the Zabbix issue ZBX-25635 for maintainer notes on the underlying defect.

Attack Vector

An attacker with valid low-privileged credentials, or access to any account that can obtain a zbx_session cookie, generates a forged cookie asserting the Admin role. The attacker submits the cookie to the Zabbix frontend and is treated as an authenticated administrator. From there the attacker can create user accounts, execute remote commands via Zabbix scripts, and pivot into monitored systems.

No verified public proof-of-concept code is available. The vulnerability is described in prose only; see the Zabbix advisory ZBX-25635 for authoritative technical details.

Detection Methods for CVE-2024-36466

Indicators of Compromise

Unexpected zbx_session cookies presented to the Zabbix frontend from IP addresses not associated with legitimate users.
New administrative user accounts, API tokens, or global scripts created in Zabbix outside of change-management windows.
Sudden execution of Zabbix remote commands or scripts against monitored hosts without a corresponding alert or automation trigger.
Audit log entries showing privilege changes on low-privileged accounts followed by administrative actions.

Detection Strategies

Compare active zbx_session cookie identifiers against server-side session records and flag cookies that fail server-side lookup but are accepted by the frontend.
Alert on Zabbix audit log events for user creation, permission changes, and script execution originating from newly seen source IPs.
Correlate authentication events with subsequent administrative API calls to identify privilege jumps within a single session.

Monitoring Recommendations

Forward Zabbix frontend access logs and audit logs to a centralized SIEM for retention and correlation.
Monitor egress from the Zabbix server for unexpected outbound connections that could indicate post-exploitation activity.
Baseline administrative activity per user and alert on deviations, especially outside business hours.

How to Mitigate CVE-2024-36466

Immediate Actions Required

Upgrade Zabbix to a fixed release: 5.0.43, 6.0.31, 6.4.16, or 7.0.1 or later, as documented in ZBX-25635.
Rotate all Zabbix administrator credentials and API tokens after patching.
Invalidate existing sessions by clearing the sessions table or forcing all users to re-authenticate.
Review Zabbix audit logs for administrative actions since the vulnerability was disclosed and roll back unauthorized changes.

Patch Information

Zabbix released fixed builds tracked under ZBX-25635. Apply the vendor patch matching your major version and restart the Zabbix frontend and server components. Verify that the deployed version reports a build higher than the affected ranges before restoring normal access.

Workarounds

Restrict network access to the Zabbix frontend using firewall or reverse proxy rules so only trusted management networks can reach it.
Enforce multi-factor authentication at an upstream identity provider or reverse proxy in front of the Zabbix frontend.
Disable or reduce the privileges of any Zabbix accounts that are not strictly required until patching is complete.

bash

# Example: restrict Zabbix frontend to a management subnet using nginx
location / {
    allow 10.10.0.0/24;
    deny all;
    proxy_pass http://127.0.0.1:8080;
}