CVE-2022-24919

What it actually does

An authenticated user can inject reflected JavaScript into a link for the graphs page; the payload executes in the victim's browser only if the attacker's link includes the victim's current CSRF token, granting the script the same DOM access as the legitimate page and allowing arbitrary content modifications.

Why it matters to the business

Successful social-engineering attacks can alter what users see on the graphs page, enabling phishing, credential theft, or unauthorized actions without persistent code on the server.

How an attack unfolds

An authenticated attacker crafts a URL containing malicious JavaScript for the graphs page, obtains the victim's current CSRF token through another channel or timing, and sends the link to the victim; when the victim clicks it the script runs with the victim's session privileges and can modify page contents in real time.

How to fix it

Upgrade the Zabbix frontend to a release that sanitizes all graph-page parameters and enforces strict CSRF validation; until then disable or restrict the graphs feature for untrusted users and enforce a strict Content-Security-Policy header.

How to confirm the fix worked

After upgrade, attempt to load a graphs URL containing a script tag and confirm the payload is rejected or escaped; scan recent web-access logs for any graph requests that contain script, javascript:, or data: schemes.

Typical attack path

1. Attacker authenticates with a low-privileged account
2. Attacker builds a graphs-page URL that embeds attacker-controlled JavaScript and the victim's current CSRF token
3. Attacker distributes the crafted link via email, chat, or another trusted channel
4. Victim clicks the link while logged in, causing the browser to execute the injected script
5. Script performs actions visible to the victim such as displaying fake forms or exfiltrating displayed data

How to detect it

Review web-server access logs for graphs requests whose query strings contain script, javascript:, or encoded angle brackets; correlate any such requests with subsequent unusual DOM changes reported by users or browser telemetry.

What your security team should do

• Apply the vendor patch for the Zabbix frontend at the earliest maintenance window
• Add a Content-Security-Policy that blocks inline scripts on all authenticated pages
• Train users to treat unexpected graphs links with caution and to verify sender identity
• Enable enhanced logging of graph-page requests that contain non-alphanumeric parameters