CVE-2021-27927: 
Zabbix Server vulnerability analysis and mitigation

In Zabbix from versions 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, a critical Cross-Site Request Forgery (CSRF) vulnerability was identified in the CControllerAuthenticationUpdate controller. The vulnerability exists due to the lack of CSRF protection mechanism, where the controller explicitly disables SID validation in the init() method. An attacker can exploit this vulnerability without knowing Zabbix user login credentials, requiring only the correct Zabbix URL and contact information of an existing user with sufficient privileges (NVD, Horizon3).

The vulnerability stems from the CControllerAuthenticationUpdate controller having token validation turned off. Additionally, any parameters submitted in a request body via POST could equivalently be submitted as URL query parameters via GET. The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack is exploitable even with the default SameSite=Lax cookie protection in place, as it leverages GET requests that trigger top-level navigation (Horizon3).

The impact of this vulnerability is severe as it can lead to full takeover of the Zabbix administrator account. Once administrative access is gained, attackers can access detailed information about other devices on the network and execute arbitrary commands on the Zabbix server. In certain configurations, attackers can also execute arbitrary commands on hosts being monitored by Zabbix. At the time of discovery, approximately 20,000 instances of Zabbix were exposed on the Internet (Horizon3).

The vulnerability requires user interaction but is relatively straightforward to exploit. An attacker needs to set up a malicious LDAP server accessible to the target Zabbix application, create a web page containing the forged cross-site request, and convince the Zabbix administrator to click on a malicious link. The attack is not blind, as the attacker can verify success through the Zabbix application's LDAP server connection test (Horizon3).

The vulnerability is fixed in Zabbix versions 4.0.28rc1, 5.0.8rc1, 5.2.4rc1, and 5.4.0alpha1. Organizations should upgrade to these versions or newer to protect against this vulnerability. The fix was released on February 22, 2021, after being disclosed to the vendor on January 3, 2021 (Horizon3).