CVE-2022-23134
Zabbix Frontend Improper Access Control Vulnerability
Description
CVE-2022-23134 is a LOW severity improper access control vulnerability in Zabbix Frontend affecting versions 5.4.0 through 5.4.8 and 6.0.0. The flaw allows unauthenticated malicious actors to bypass step checks in the initial setup process and potentially change the configuration of the Zabbix Frontend, including modifying database connection settings. With a CVSS 3.1 score of 3.7 and a notably high EPSS score of 0.93119 (99.8th percentile), this vulnerability demonstrates a striking disconnect between its low CVSS severity and extremely high real-world exploitation activity. CVE-2022-23134 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 8, 2022, though no ransomware association is documented. The vulnerability is classified under CWE-284 (Improper Access Control) and CWE-287 (Improper Authentication).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| zabbix | zabbix | >= 5.4.0, <= 5.4.8; 6.0.0 |
| fedoraproject | fedora | 34; 35 |
| debian | debian linux | 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/(Release Notes)
- https://support.zabbix.com/browse/ZBX-20384(Issue Tracking, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23134(US Government Resource)
Weakness Type
CWE-284: Improper Access Control / CWE-287: Improper Authentication
Improper Access Control (CWE-284) occurs when software fails to properly restrict access to resources from unauthorized actors. This broad category encompasses authentication bypass, authorization bypass, and improper enforcement of access policies. Proper access control involves determining who can access what resources and what actions they can perform. Learn more about CWE-284. Improper Authentication (CWE-287) occurs when an application fails to prove or insufficiently proves that a user's claimed identity is correct, encompassing flaws like bypassable authentication logic and missing authentication checks on critical endpoints.
In CVE-2022-23134, the Zabbix Frontend's setup page (setup.php) can be accessed by unauthenticated users after the initial installation has been completed. Under normal operation, the setup wizard should only be accessible during initial configuration and should require authentication for any subsequent access. However, the vulnerable versions fail to enforce proper access control on the setup page's step validation, allowing an unauthenticated attacker to navigate directly to configuration steps that should be restricted. This enables modification of the Zabbix Frontend configuration, most critically the database connection parameters, which could be redirected to an attacker-controlled database server. Learn more about CWE-284 at turingsecure.com and CWE-287 at turingsecure.com.
Impact Analysis
CVE-2022-23134 carries a CVSS 3.1 score of 3.7 (LOW) with an Unchanged scope, which significantly understates the real-world risk as evidenced by its extremely high EPSS score.
Confidentiality (None): The CVSS assessment rates confidentiality impact as None because the vulnerability itself does not directly expose data. However, the practical confidentiality impact can be severe when exploitation is chained with further attacks. By redirecting the Zabbix database connection to an attacker-controlled server, the attacker can capture authentication credentials submitted through the Frontend, gaining access to monitoring data for the entire infrastructure.
Integrity (Low): The direct integrity impact is rated Low because the vulnerability allows modification of the Zabbix Frontend configuration. However, the ability to change database connection settings represents a significant integrity risk. An attacker can redirect the Frontend to connect to a malicious database, enabling them to inject fake monitoring data, suppress real alerts, or manipulate the application's behavior in ways that undermine the integrity of the entire monitoring infrastructure.
Availability (None): The CVSS assessment rates availability impact as None for the direct vulnerability. However, reconfiguring the database connection can effectively render the Zabbix monitoring system non-functional, creating a monitoring blind spot across the infrastructure. Loss of monitoring visibility is an indirect but serious availability impact, as it enables further attacks to proceed undetected.
Scope (Unchanged): The scope is Unchanged as the impact is contained within the Zabbix Frontend component. Despite the low CVSS score, the EPSS score of 0.93119 at the 99.8th percentile reveals that this vulnerability is among the most actively targeted in the wild, likely because Zabbix instances are commonly internet-facing and the exploitation requires no authentication or complex conditions.
Exploit Maturity
Active Exploitation: CVE-2022-23134 is confirmed to have been actively exploited in the wild, as indicated by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog added on February 22, 2022. Despite its low CVSS score of 3.7, the vulnerability is trivially exploitable over the network by unauthenticated attackers, making it an attractive target for automated scanning and exploitation campaigns.
Ransomware Association: CISA's KEV catalog does not indicate a known ransomware association for CVE-2022-23134. However, compromising a monitoring system like Zabbix provides attackers with detailed infrastructure intelligence that can facilitate subsequent ransomware deployment by revealing network topology, system inventory, and security monitoring gaps.
Public Exploits: The vulnerability details are documented in the Zabbix support portal (ZBX-20384) and security advisories from Debian and Fedora. The exploitation technique is straightforward — accessing the setup.php page directly without authentication — making it accessible to even unsophisticated threat actors. No complex exploit code is required; standard web requests suffice.
EPSS Context: The EPSS score of 0.93119 at the 99.8th percentile is remarkably high for a vulnerability with a CVSS score of only 3.7, highlighting the significant gap between theoretical severity ratings and actual exploitation patterns. This score indicates that automated scanning for this vulnerability is extremely widespread, likely targeting the many internet-exposed Zabbix instances.
KEV Remediation Deadline: CISA set an unusually short remediation deadline of March 8, 2022, just 14 days from the catalog addition date of February 22, 2022, reflecting the urgency of the active exploitation threat.
Remediation
-
Update Zabbix to the latest patched version immediately. Upgrade Zabbix Frontend to version 5.4.9 or later (for the 5.4 branch) or version 6.0.1 or later (for the 6.0 branch). Follow the official Zabbix upgrade guide to ensure a smooth update process without data loss.
-
Restrict network access to the Zabbix Frontend. Ensure that the Zabbix web interface is not directly exposed to the internet. Place it behind a VPN, reverse proxy with authentication, or firewall that limits access to authorized networks and IP addresses only. Zabbix monitoring dashboards should never be publicly accessible.
-
Block direct access to setup.php via web server configuration. As an immediate mitigation, configure your web server (Apache, Nginx) to deny access to the
setup.phpfile after initial installation is complete. For Nginx:location = /setup.php { deny all; }. For Apache:<Files setup.php> Require all denied </Files>. This prevents exploitation even if the Zabbix update cannot be immediately applied. -
Verify Zabbix configuration integrity. After applying the update, review the Zabbix Frontend configuration file (
zabbix.conf.php) to verify that database connection parameters have not been tampered with. Compare the configuration against known-good backups and confirm that the database server address, port, and credentials point to the legitimate Zabbix database. -
Audit web server access logs for exploitation attempts. Review web server logs for requests to
setup.phpfrom unexpected IP addresses or at unusual times. Any access to the setup page after initial installation may indicate exploitation attempts. Investigate any configuration changes that occurred during the period the vulnerability was unpatched. -
Implement web application firewall (WAF) rules. Deploy WAF rules to block requests targeting the Zabbix setup endpoint. Configure alerting for any access attempts to the setup.php URL path to enable rapid detection and response to future exploitation attempts against the Zabbix infrastructure.
Technical Details
CVE-2022-23134 is an access control bypass vulnerability in the Zabbix Frontend web application affecting versions 5.4.0 through 5.4.8 and version 6.0.0. The vulnerability exists in the setup.php file, which implements the Zabbix initial configuration wizard. This wizard guides administrators through the setup process including database connection configuration, server details, and GUI settings.
Under normal operation, the setup wizard should only be accessible during the initial installation of Zabbix. Once installation is complete and a configuration file has been written, the setup page should either be removed or protected by authentication. However, in the affected versions, the setup page fails to properly validate that the installation has been completed and does not enforce authentication for subsequent access to the configuration steps.
The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) assigns a Network attack vector with no required privileges and no user interaction, but rates the attack complexity as High. This High complexity rating accounts for the fact that exploitation requires specific conditions — notably that the attacker needs to know or discover the Zabbix instance URL and the setup page must be accessible. However, the practical attack complexity is significantly lower than the CVSS suggests, as Zabbix instances are commonly discoverable through internet scanning and the setup.php path is deterministic.
The most critical exploitation path involves navigating to the database configuration step and changing the database server address to an attacker-controlled system. This allows the attacker to redirect all database queries from the Zabbix Frontend to their own server, capturing credentials and potentially serving manipulated data. The root cause is a missing authentication check in the setup page controller that should verify the current user is an authenticated administrator before allowing any configuration changes.
Frequently Asked Questions
What is CVE-2022-23134?
CVE-2022-23134 is an access control bypass vulnerability in the Zabbix Frontend web interface that allows unauthenticated attackers to access the setup wizard and modify the application's configuration. It affects Zabbix versions 5.4.0 through 5.4.8 and version 6.0.0. Despite its low CVSS score of 3.7, the vulnerability has an EPSS score of 0.93119 (99.8th percentile), indicating extremely high exploitation activity in the wild, and is listed in CISA's KEV catalog.
Why does CVE-2022-23134 have such a high EPSS score despite a low CVSS score?
The discrepancy between the low CVSS 3.1 score (3.7) and the extremely high EPSS score (99.8th percentile) reflects a gap between theoretical severity and real-world exploitation patterns. The vulnerability requires no authentication, targets network-accessible monitoring infrastructure, and can be exploited with simple HTTP requests — making it ideal for automated scanning campaigns. Zabbix instances are commonly internet-exposed, providing a large attack surface. The CVSS score underweights these practical factors.
What can an attacker do by exploiting CVE-2022-23134?
By exploiting CVE-2022-23134, an unauthenticated attacker can access the Zabbix Frontend setup wizard and modify the application configuration, including the database connection settings. This allows redirecting the Zabbix Frontend to connect to an attacker-controlled database, capturing authentication credentials, injecting false monitoring data, and suppressing legitimate alerts. Compromising a monitoring system also provides detailed infrastructure intelligence that can enable further attacks.
How do I protect my Zabbix installation from CVE-2022-23134?
Update Zabbix to version 5.4.9 or later (5.4 branch) or 6.0.1 or later (6.0 branch). As an immediate mitigation, block access to setup.php in your web server configuration. Ensure the Zabbix Frontend is not directly exposed to the internet by placing it behind a VPN or firewall. Review your Zabbix configuration file to verify database connection parameters have not been tampered with, and audit web server logs for any suspicious access to the setup page.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.