// For flags

CVE-2024-42327

SQL injection in user.get API

Severity Score

9.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

Una cuenta de usuario que no sea administrador en la interfaz de Zabbix con el rol de usuario predeterminado o con cualquier otro rol que proporcione acceso a la API puede aprovechar esta vulnerabilidad. Existe una SQLi en la clase CUser en la función addRelatedObjects; esta función se llama desde la función CUser.get, que está disponible para todos los usuarios que tienen acceso a la API.

*Credits: Zabbix wants to thank Márk Rákóczi (reeeeeeeeeeee) for submitting this report on the HackerOne bug bounty platform.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-07-30 CVE Reserved
  • 2024-11-27 CVE Published
  • 2024-11-27 CVE Updated
  • 2024-11-28 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
  • CAPEC-233: Privilege Escalation
References (1)
URL Tag Source
https://support.zabbix.com/browse/ZBX-25623
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zabbix
Search vendor "Zabbix"
 Zabbix
Search vendor "Zabbix" for product "Zabbix"
 >= 6.0.0 <= 6.0.31
Search vendor "Zabbix" for product "Zabbix" and version " >= 6.0.0 <= 6.0.31"
en
Affected
Zabbix
Search vendor "Zabbix"
 Zabbix
Search vendor "Zabbix" for product "Zabbix"
 >= 6.4.0 <= 6.4.16
Search vendor "Zabbix" for product "Zabbix" and version " >= 6.4.0 <= 6.4.16"
en
Affected
Zabbix
Search vendor "Zabbix"
 Zabbix
Search vendor "Zabbix" for product "Zabbix"
 >= 7.0.0 <= 7.0.1
Search vendor "Zabbix" for product "Zabbix" and version " >= 7.0.0 <= 7.0.1"
en
Affected