CVE-2025-27232: Zabbix Information Disclosure Flaw

CVE-2025-27232 Overview

CVE-2025-27232 is a Server-Side Request Forgery (SSRF) vulnerability affecting Zabbix, an enterprise-class open source distributed monitoring solution. An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver, leading to potential confidentiality loss through unauthorized information disclosure.

This vulnerability is classified under CWE-918 (Server-Side Request Forgery) and has been assigned a CVSS 4.0 score of 6.8 (MEDIUM severity). While exploitation requires authenticated Super Admin privileges and adjacent network access, successful attacks could expose sensitive configuration files, credentials, or other confidential data stored on the web server.

Critical Impact

Authenticated Super Admin users can leverage the oauth.authorize action to perform arbitrary file reads, potentially exposing sensitive server-side configuration files, credentials, and confidential data.

Affected Products

• Zabbix (versions affected per vendor advisory)
• Zabbix Web Frontend with OAuth functionality enabled
• Systems running Zabbix with Super Admin accounts

Discovery Timeline

• 2025-12-01 - CVE-2025-27232 published to NVD
• 2025-12-01 - Last updated in NVD database

Technical Details for CVE-2025-27232

Vulnerability Analysis

The vulnerability resides in Zabbix's OAuth authorization implementation, specifically within the oauth.authorize action handler. This Server-Side Request Forgery (SSRF) vulnerability allows an authenticated user with Super Admin privileges to manipulate OAuth authorization requests to read arbitrary files from the underlying webserver filesystem.

The CVSS 4.0 vector CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N indicates:

• Attack Vector (AV:A): Adjacent Network - attacker must have access to the local network segment
• Attack Complexity (AC:L): Low - exploitation is straightforward once prerequisites are met
• Privileges Required (PR:H): High - Super Admin authentication is mandatory
• User Interaction (UI:N): None - no victim interaction required
• Confidentiality Impact (VC:H): High - significant data exposure possible
• Integrity Impact (VI:N): None - no data modification capability
• Availability Impact (VA:N): None - system availability unaffected

The EPSS (Exploit Prediction Scoring System) probability is 0.019% (4.305 percentile), indicating a relatively low likelihood of exploitation in the wild at this time.

Root Cause

The root cause is improper input validation in the OAuth authorization flow within Zabbix. The oauth.authorize action fails to adequately sanitize or restrict file path parameters, allowing attackers to specify arbitrary local file paths. The server-side component then reads and potentially returns the contents of these files, treating them as valid OAuth authorization data.

This is a classic SSRF pattern where user-controlled input is used to construct server-side file read operations without proper restrictions or allowlist validation.

Attack Vector

The attack requires the following conditions:

1. The attacker must have valid Zabbix Super Admin credentials
2. The attacker must have adjacent network access to the Zabbix web frontend
3. OAuth functionality must be enabled on the target Zabbix instance

The attacker exploits the vulnerability by crafting malicious requests to the oauth.authorize endpoint. By manipulating the authorization parameters, the attacker can redirect the server to read local filesystem resources instead of legitimate OAuth provider URLs. This allows exfiltration of sensitive files such as /etc/passwd, application configuration files, database credentials, or other sensitive server-side data.

The vulnerability does not require any user interaction and can be exploited repeatedly to enumerate and exfiltrate multiple files from the target system.

Detection Methods for CVE-2025-27232

Indicators of Compromise

• Unusual or repeated requests to the oauth.authorize endpoint from Super Admin accounts
• OAuth authorization requests containing file path characters (e.g., ../, /etc/, file://)
• Server access logs showing OAuth actions with local filesystem path patterns
• Unexpected file read operations originating from the Zabbix web process
• Authentication logs showing Super Admin activity during non-business hours

Detection Strategies

Organizations should implement the following detection mechanisms:

1. Web Application Firewall (WAF) Rules: Configure rules to detect and block requests containing path traversal sequences or local file path patterns in OAuth-related endpoints.

2. Log Monitoring: Enable detailed logging for all OAuth-related actions and monitor for anomalous patterns, particularly requests with unusual path specifications.

3. Behavioral Analysis: Monitor Super Admin account activity for unusual patterns, including access to OAuth configuration from unexpected source IPs or at unusual times.

4. File Integrity Monitoring: Deploy file integrity monitoring on sensitive configuration files to detect unauthorized read attempts or access pattern anomalies.

Monitoring Recommendations

• Enable verbose logging on Zabbix web frontend, particularly for API and OAuth actions
• Implement centralized log collection and analysis for Zabbix instances
• Configure alerts for Super Admin authentication events and subsequent OAuth operations
• Monitor network traffic for data exfiltration patterns following OAuth endpoint access
• Establish baseline behavior for OAuth usage and alert on deviations

How to Mitigate CVE-2025-27232

Immediate Actions Required

• Apply the latest security patches from Zabbix as detailed in the vendor advisory ZBX-27282
• Review and audit all Super Admin accounts, removing unnecessary elevated privileges
• Implement network segmentation to restrict adjacent network access to Zabbix instances
• Enable enhanced logging and monitoring on all Zabbix web frontends
• Consider temporarily disabling OAuth functionality if not required

Patch Information

Zabbix has acknowledged this vulnerability and provided remediation guidance through their support portal. Administrators should consult the official Zabbix security advisory at https://support.zabbix.com/browse/ZBX-27282 for specific patch information, affected version details, and upgrade instructions.

It is strongly recommended to apply vendor-provided patches as soon as they become available for your Zabbix version. Organizations should follow their standard change management procedures while prioritizing this security update.

Workarounds

If immediate patching is not possible, organizations can implement the following temporary mitigations:

1. Disable OAuth Authentication: If OAuth is not essential for operations, consider disabling OAuth functionality in Zabbix until patches can be applied.

2. Restrict Super Admin Access: Minimize the number of Super Admin accounts and implement strict access controls, including IP allowlisting for administrative access.

3. Network Segmentation: Ensure Zabbix web frontends are only accessible from trusted network segments, reducing the adjacent network attack surface.

4. Web Application Firewall: Deploy WAF rules to inspect and filter requests to OAuth endpoints for path traversal and file inclusion patterns.

5. Enhanced Monitoring: Implement additional monitoring and alerting for all Super Admin activity, particularly OAuth-related operations.