Horizon Alert
Summary of the vulnerability and why it matters
When SAML single sign-on is enabled in Zabbix, a vulnerability exists that allows an unauthenticated actor to modify session data. This occurs because user logins within the session are not properly verified. Exploitation of this flaw can lead to privilege escalation, granting an attacker administrative access to the Zabbix Frontend.
- Vulnerable Zabbix component: Frontend with SAML SSO
- Core weakness: Unverified session data
- Main business impact: Unauthorized administrative access
Attack Path
How an attacker could exploit the issue
An unauthenticated actor can exploit a vulnerability in Zabbix Frontend when SAML single sign-on is enabled. By manipulating session data, an attacker can escalate privileges to gain administrative access to the Zabbix Frontend. This attack requires SAML authentication to be configured and knowledge of a valid Zabbix username, or the use of the guest account if enabled.
- SAML SSO must be enabled.
- Attacker modifies session data.
- Attacker gains admin access.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to gain administrative access to Zabbix Frontend. Exploitation requires SAML authentication to be enabled and knowledge of a Zabbix username or the guest account. The modification of session data can lead to privilege escalation. This presents a significant risk to the integrity and availability of monitoring systems and the data they manage.
- Likely attacker skill level: Low
- Required access or conditions: SAML enabled, known username
- Business risk or urgency: High impact, urgent remediation
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
The identified vulnerability allows an unauthenticated actor to escalate privileges and gain administrative access to the Zabbix Frontend when SAML SSO authentication is enabled. This requires the attacker to know a Zabbix username or use the guest account, which is disabled by default. The exploitability of this issue is high due to its network-attack vector and lack of required privileges.
- Identify Zabbix frontend instances with SAML SSO enabled.
- Restrict network access to affected Zabbix frontends.
- Apply vendor updates and validate.
- Monitor for related suspicious activity.
