CVE-2024-36466

What it actually does

The vulnerability permits an attacker to craft and cryptographically sign a forged zbx_session cookie that the application accepts as valid, resulting in immediate authentication as an administrator without any credentials.

Why it matters to the business

Attackers can gain full administrative control over the Zabbix monitoring platform, enabling them to view sensitive infrastructure data, alter monitoring configurations, or disrupt operations, though the low exploitation likelihood and absence from known campaigns reduce immediate organizational risk.

How an attack unfolds

An attacker locates a Zabbix instance, analyzes the session cookie handling logic to discover the signing flaw, generates a valid-looking zbx_session cookie containing admin privileges, and submits it to the login endpoint to obtain an authenticated session.

How to fix it

Upgrade the Zabbix codebase to the commit e0ebc610bbe07feec683b36b33b0c7c54d4dfa51 or later; verify the patch is applied by confirming the corrected cookie signing logic is present.

How to confirm the fix worked

Review the git history for the presence of commit e0ebc610bbe07feec683b36b33b0c7c54d4dfa51, attempt to forge an admin session cookie on a test instance, and confirm that only legitimately signed sessions are accepted.

Typical attack path

1. Discover publicly reachable Zabbix web interface
2. Craft a forged zbx_session cookie using the signing bypass
3. Submit the cookie to the application to establish an admin session
4. Perform privileged actions such as data exfiltration or configuration changes

How to detect it

Inspect web server access logs and application logs for zbx_session cookie values that do not match expected signing patterns or that appear with admin-level claims from unexpected source IPs.

• zbx_session
• forged zbx_session cookie

What your security team should do

• Apply the fixed commit e0ebc610bbe07feec683b36b33b0c7c54d4dfa51 immediately on all Zabbix deployments
• Audit recent admin logins for anomalies even though exploitation likelihood remains low
• Monitor upstream Zabbix releases for any follow-on patches