CVE-2025-49643
📋 TL;DR
An authenticated Zabbix user (including Guest accounts) can send specially crafted parameters to /imgstore.php, causing excessive CPU consumption on the webserver. This leads to potential denial of service by overwhelming server resources. All Zabbix installations with vulnerable versions are affected.
💻 Affected Systems
- Zabbix
📦 What is this software?
Frontend by Zabbix
Frontend by Zabbix
Frontend by Zabbix
Frontend by Zabbix
⚠️ Risk & Real-World Impact
Worst Case
Complete webserver unavailability due to CPU exhaustion, disrupting monitoring and potentially affecting dependent systems.
Likely Case
Degraded webserver performance causing slow response times or intermittent outages for Zabbix web interface users.
If Mitigated
Minimal impact with proper authentication controls and rate limiting in place.
🎯 Exploit Status
Requires authenticated access but Guest accounts qualify; exploitation involves simple HTTP requests with crafted parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check ZBX-27284 for specific patched versions
Vendor Advisory: https://support.zabbix.com/browse/ZBX-27284
Restart Required: Yes
Instructions:
1. Check current Zabbix version
2. Download and apply patch from Zabbix repository
3. Restart Zabbix server and web services
4. Verify fix by testing /imgstore.php endpoint
🔧 Temporary Workarounds
Disable Guest Access
allRemove or disable Guest user accounts to reduce attack surface.
UPDATE users SET attempt_failed=10 WHERE alias='guest';
UPDATE users SET attempt_clock=UNIX_TIMESTAMP() WHERE alias='guest';
Implement Rate Limiting
linuxConfigure web server or WAF to limit requests to /imgstore.php.
# For nginx: limit_req_zone $binary_remote_addr zone=zabbix:10m rate=10r/s;
# Add to location block: limit_req zone=zabbix burst=20;
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Zabbix server from untrusted networks.
- Deploy a web application firewall (WAF) with DoS protection rules for /imgstore.php.
🔍 How to Verify
Check if Vulnerable:
Test by sending crafted parameters to /imgstore.php as authenticated user and monitor CPU spikes.Check Version:
zabbix_server --version | grep versionVerify Fix Applied:
After patching, attempt exploitation again; CPU should not spike abnormally.📡 Detection & Monitoring
Log Indicators:
- High frequency requests to /imgstore.php in web server logs
- CPU usage alerts from Zabbix server monitoring
Network Indicators:
- Unusual traffic patterns to /imgstore.php endpoint
- Multiple authenticated sessions from single source
SIEM Query:
source="zabbix_access.log" AND uri="/imgstore.php" AND status=200 | stats count by src_ip