CVE-2025-27232: Zabbix Frontend Information Disclosure Flaw

CVE-2025-27232 Overview

CVE-2025-27232 is an arbitrary file read vulnerability in the Zabbix Frontend oauth.authorize action. An authenticated user with Zabbix Super Admin privileges can abuse the OAuth authorization flow to read arbitrary files from the underlying webserver. The flaw is classified under CWE-918 (Server-Side Request Forgery) and impacts the confidentiality of files accessible to the web application process. Exploitation requires high privileges and adjacent network access, limiting attack surface but posing risk in multi-tenant or delegated administration deployments where Super Admin trust boundaries matter.

Critical Impact
A malicious or compromised Zabbix Super Admin account can exfiltrate arbitrary files, including configuration files, credentials, and secrets, from the Zabbix web server host.

Affected Products

Zabbix Frontend (zabbix:frontend)
Deployments exposing the OAuth authorization workflow to Super Admin users
Zabbix web application instances tracked under bug report ZBX-27282

Discovery Timeline

2025-12-01 - CVE-2025-27232 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27232

Vulnerability Analysis

The vulnerability resides in the Zabbix Frontend oauth.authorize action. This action handles OAuth authorization requests and processes attacker-influenced input that is later resolved against server-side resources. Because the action does not restrict the resource identifier to expected OAuth endpoints, a Super Admin can direct it to read local files or internal endpoints. The result is a confidentiality-only impact: file contents accessible to the webserver process can be retrieved through the response path.

The issue is categorized as Server-Side Request Forgery (SSRF), which in Zabbix's implementation extends to local file access. Integrity and availability are not affected, and the attacker must already hold the highest role in the Zabbix application.

Root Cause

The root cause is insufficient validation of resource targets in the oauth.authorize handler. The action accepts input that controls a server-issued request or file lookup without enforcing a strict allowlist of remote OAuth endpoints. Because the webserver process typically has read access to Zabbix configuration files, PHP source, and system files, this trust gap enables arbitrary file disclosure.

Attack Vector

Exploitation requires an authenticated session with Super Admin role and network reachability to the Zabbix Frontend, characterized as an adjacent network attack vector. The attacker invokes the oauth.authorize action and supplies crafted parameters that redirect the internal resource request to a local file path or internal URL. The response is returned through the OAuth flow, disclosing file contents. No user interaction is required beyond the attacker's own authenticated request.

No public proof-of-concept exploit is available at the time of publication. Refer to the Zabbix Bug Report ZBX-27282 for vendor-confirmed technical details.

Detection Methods for CVE-2025-27232

Indicators of Compromise

Unexpected HTTP requests to the oauth.authorize endpoint originating from Super Admin sessions
OAuth authorization requests containing local file URIs, file:// schemes, or internal IP addresses in redirect or resource parameters
Zabbix audit log entries showing OAuth configuration changes correlated with atypical Super Admin activity
Webserver process reads of sensitive files such as /etc/passwd, zabbix.conf.php, or credential stores immediately following oauth.authorize calls

Detection Strategies

Monitor Zabbix Frontend access logs for action=oauth.authorize requests and correlate with the requesting user role and source IP.
Alert on OAuth-related parameters containing non-HTTPS schemes, loopback addresses, or path traversal sequences.
Baseline normal OAuth authorization activity per Super Admin and flag statistical anomalies in request volume or targets.

Monitoring Recommendations

Enable and forward Zabbix audit logs to a centralized SIEM for retention and correlation.
Monitor webserver file access patterns for reads of sensitive configuration files by the PHP-FPM or Apache worker process.
Track Super Admin session creation and privileged action usage to detect account compromise or insider misuse.

How to Mitigate CVE-2025-27232

Immediate Actions Required

Review the Zabbix Bug Report ZBX-27282 and apply the fixed Zabbix Frontend version referenced by the vendor.
Audit the list of accounts assigned the Super Admin role and remove unnecessary assignments.
Rotate any credentials or secrets stored in files readable by the Zabbix webserver process if exposure is suspected.
Restrict network access to the Zabbix Frontend to trusted administrative networks only.

Patch Information

Zabbix has tracked and addressed the issue under bug report ZBX-27282. Administrators should upgrade the Zabbix Frontend to the fixed version identified in the vendor advisory. No public exploit is currently available, but authenticated Super Admin access makes patching a priority for environments with delegated or shared administrative accounts.

Workarounds

Enforce strong authentication and multi-factor authentication for all Zabbix Super Admin accounts until patching is complete.
Place the Zabbix Frontend behind a reverse proxy that filters requests to the oauth.authorize action based on source IP or session context.
Run the Zabbix webserver process under a least-privilege account with restricted filesystem read access to minimize the scope of file disclosure.
Disable or remove unused OAuth integrations if the feature is not required in the environment.

bash

# Example: restrict access to oauth.authorize at the reverse proxy layer (nginx)
location /zabbix/ {
    if ($arg_action = "oauth.authorize") {
        allow 10.0.0.0/24;   # trusted admin subnet
        deny all;
    }
    proxy_pass http://zabbix_backend;
}