CVE-2021-27925: 
Couchbase vulnerability analysis and mitigation

The vulnerability CVE-2021-27925 was discovered in Zabbix, an enterprise IT network and application monitoring solution. The vulnerability is a Cross-Site Request Forgery (CSRF) vulnerability in the authentication component of the Zabbix UI that could allow an unauthenticated attacker to take over the Zabbix administrator's account if they can persuade the administrator to follow a malicious link. The vulnerability was discovered in early 2021 and was fixed in Zabbix versions 4.0.28rc1, 5.0.8rc1, 5.2.4rc1, and 5.4.0alpha1 (Horizon3 Blog).

The vulnerability exists because the backend controller class CControllerAuthenticationUpdate that handles authentication form submission had token validation turned off. Additionally, any parameters submitted in a request body via POST could equivalently be submitted as URL query parameters via GET. This meant that forged GET requests missing the required sid (anti-CSRF token) parameter could still work. The vulnerability is exploitable in all browsers even with the default SameSite=Lax cookie protection in place (Horizon3 Blog).

The impact of this vulnerability is high. A successful exploit leads to full takeover of the Zabbix administrator account. Administrative access to Zabbix provides attackers access to information about other devices on the network and the ability to execute arbitrary commands on the Zabbix server. In certain configurations, attackers can also execute arbitrary commands on hosts being monitored by Zabbix (Horizon3 Blog).

The vulnerability requires user interaction to exploit, specifically requiring the Zabbix administrator to follow a malicious link. The attacker needs to set up an attacker-controlled LDAP server that is network accessible to the target Zabbix application and host a malicious HTML page containing the forged cross-site request. When the victim visits the malicious site, the authentication settings on the Zabbix instance are automatically updated to use the attacker's LDAP server (Horizon3 Blog).

The vulnerability has been fixed in Zabbix versions 4.0.28rc1, 5.0.8rc1, 5.2.4rc1, and 5.4.0alpha1. Organizations should upgrade to these or newer versions to protect against this vulnerability (Horizon3 Blog).