CVE-2022-24349

What it actually does

Authenticated users can inject reflected XSS payloads into links for actions' pages, enabling arbitrary JavaScript execution in victims' browsers with full access to page DOM objects and the ability to modify displayed content.

Why it matters to the business

Attackers may manipulate monitoring dashboards or steal session data from other users, leading to unauthorized visibility into infrastructure or potential account takeover without direct system access.

How an attack unfolds

An attacker with valid frontend credentials crafts a link embedding an XSS payload targeting actions pages, then uses social engineering over a trusted channel to deliver it to another authenticated user whose browser executes the code upon interaction.

How to fix it

Apply patches addressing input sanitization for actions pages links in Zabbix Frontend; enforce strict input validation and consider disabling unnecessary link sharing features until updated.

How to confirm the fix worked

Test actions pages link generation with known XSS vectors such as script tags or event handlers to confirm sanitization; review web application firewall rules and audit logs for blocked payloads post-update.

Typical attack path

1. Obtain authenticated access to Zabbix Frontend
2. Construct malicious link containing reflected XSS payload for actions pages
3. Deliver link to target user via trusted communication channel
4. Victim clicks link and payload executes in browser context
5. Malicious code accesses page objects and performs modifications or data exfiltration

How to detect it

Examine web server access logs for actions pages requests containing unusual parameters or HTML tags; correlate with user activity for unexpected modifications to dashboard content or session anomalies.

• actions.php? with script or onerror in query string
• javascript:alert or <img src=x onerror in frontend URLs
• unexpected DOM modifications logged in browser console during actions page loads

What your security team should do

• Prioritize patching Zabbix Frontend across all instances due to age since publication
• Implement user awareness training focused on verifying links from trusted colleagues
• Enable enhanced logging for actions pages requests to detect anomalous parameters
• Review and restrict network exposure of the frontend where possible