CVE-2022-24918

What it actually does

Authenticated user can craft a link containing reflected JavaScript for the items page; execution requires the victim's current CSRF token and permits arbitrary DOM modifications within the same origin.

Why it matters to the business

Attackers can trick users into executing malicious scripts that alter displayed content, enabling social-engineering campaigns that may lead to credential theft or unauthorized actions within the monitoring interface.

How an attack unfolds

An authenticated attacker generates a malicious link embedding JavaScript and a required CSRF token, then delivers it to a victim via phishing or internal messaging; when the victim clicks the link, the script runs in the victim's browser context and modifies page contents.

How to fix it

Upgrade the Zabbix frontend to a version that properly sanitizes reflected input on the items page and enforces strict CSRF protections; apply vendor patches as they become available and review all custom or contributed frontend code for similar reflection issues.

How to confirm the fix worked

Review release notes for the presence of input sanitization and CSRF token handling fixes on the items page; test by attempting to inject script via crafted links both with and without a valid token and confirm that no script executes.

Typical attack path

1. Attacker authenticates to the application and identifies the items page endpoint.
2. Attacker crafts a URL containing reflected JavaScript payload.
3. Attacker obtains or predicts the victim's current CSRF token value.
4. Attacker delivers the crafted link to the victim through email, chat, or other channels.
5. Victim clicks the link while authenticated, causing the script to execute and alter page content.

How to detect it

Monitor web-server access logs for unusual query parameters on the items page endpoint that contain script tags or javascript: URIs; inspect browser developer tools or proxy logs for unexpected DOM modifications during authenticated sessions.

What your security team should do

• Prioritize patching the Zabbix frontend as soon as a fixed release is published.
• Enforce least-privilege access and limit the number of users who can create and share links to the items page.
• Implement additional WAF rules or content-security-policy headers to block inline script execution on the affected endpoints.
• Educate users about verifying links before clicking and reporting unexpected page behavior.