Persistent XSS in Zabbix Maps via Prototype Pollution

Executive Summary

This vulnerability is a prototype pollution issue in the function searchParamsToObject() that leads to persistent cross-site scripting (XSS) in Maps. The problem occurs when URL parameters are processed without filtering dangerous properties like __proto__. This, combined with jQuery's unsafe element creation that follows the prototype chain, allows attackers to inject malicious scripts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in your browser when you interact with the affected Maps application. This could lead to session hijacking, data theft, or unauthorized actions on your behalf. The persistent nature means the attack could remain active even after page reloads.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information to unauthorized parties, risking compliance with security requirements. Both standards mandate protection against such attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Implement input validation to filter dangerous properties like __proto__ in URL parameters. Update jQuery to a version that prevents unsafe element creation traversing the prototype chain. Review and sanitize all user-controlled data before processing.

Useful 0 Not Useful 0