CVE-2025-27232
📋 TL;DR
An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver, potentially exposing sensitive configuration files, credentials, or other confidential data. This affects Zabbix installations where Super Admin accounts exist and have access to the vulnerable endpoint.
💻 Affected Systems
- Zabbix
📦 What is this software?
Frontend by Zabbix
⚠️ Risk & Real-World Impact
Worst Case
Super Admin reads sensitive files like configuration files containing database credentials, API keys, or other secrets, leading to full system compromise.
Likely Case
Super Admin reads web server configuration files or application files to gather information for further attacks.
If Mitigated
Limited impact due to restricted Super Admin accounts and proper file permissions on the server.
🎯 Exploit Status
Exploitation requires Super Admin privileges; no public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Zabbix advisory ZBX-27282 for specific patched versions.
Vendor Advisory: https://support.zabbix.com/browse/ZBX-27282
Restart Required: Yes
Instructions:
1. Review Zabbix advisory ZBX-27282. 2. Upgrade Zabbix to the patched version. 3. Restart Zabbix server and web services.
🔧 Temporary Workarounds
Restrict Super Admin Access
allLimit the number of Super Admin accounts and enforce strong authentication.
File System Permissions
linuxSet strict file permissions on sensitive directories to prevent reading by the web server user.
chmod 600 /path/to/sensitive/files
chown root:root /path/to/sensitive/files
🧯 If You Can't Patch
- Monitor and audit Super Admin account activity for suspicious file access attempts.
- Implement network segmentation to isolate Zabbix servers from sensitive systems.
🔍 How to Verify
Check if Vulnerable:
Check if your Zabbix version is within the affected range listed in advisory ZBX-27282.Check Version:
zabbix_server --versionVerify Fix Applied:
Verify Zabbix version is updated to the patched version and test the oauth.authorize action for file reading.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Zabbix web server logs, especially to oauth.authorize endpoint.
Network Indicators:
- HTTP requests to /oauth.authorize with file paths in parameters.
SIEM Query:
source="zabbix_web.log" AND uri="/oauth.authorize" AND (param CONTAINS "file" OR param CONTAINS "path")