SQL Injection Vulnerability in Zabbix API for Non-Admin Users

What is CVE-2024-42327?

CVE-2024-42327 is a critical vulnerability found within the Zabbix frontend, an open-source monitoring solution widely used for IT infrastructure management. This vulnerability arises when a non-admin user account, even with a peripheral role such as the default User role that allows API access, can exploit a SQL injection flaw. This security weakness could potentially lead to unauthorized data access and manipulation, jeopardizing the confidentiality and integrity of sensitive organizational information.

Technical Details

The root of CVE-2024-42327 lies in a specific SQL injection vulnerability in the CUser class, specifically within the addRelatedObjects function. This function is invoked through the CUser.get function, which is accessible to any user granted API access. The exploitable nature of this flaw enables attackers to execute unauthorized SQL commands, allowing for potential data breaches or unauthorized alterations to the database.

Impact of the Vulnerability

1. Unauthorized Data Access: This vulnerability permits attackers with non-admin accounts to gain access to sensitive data that they should not have permission to view, leading to significant privacy and confidentiality breaches.

2. Data Manipulation Risks: Exploiting this vulnerability may enable attackers to modify or delete important data within the database. Such actions could disrupt the normal operation of monitoring processes and lead to severe operational impacts.

3. Increased Attack Surface: The availability of this vulnerability to non-admin users increases the risk of exploitation by malicious actors, particularly through automated scripts. This elevates the risk of various cyber threats including data exfiltration and unauthorized control over the monitoring system.

News Articles

CyberWire

CVE-2024-42327

Over 5,500 suspects arrested in Interpol operation targeting cybercrime.

Rockstar phishing kit targets Microsoft 365 users. Zabbix discloses critical vulnerability.

3 weeks ago

SecurityWeek

CVE-2024-42327

Critical Vulnerability Found in Zabbix Network Monitoring Tool

A critical-severity vulnerability in open source enterprise network monitoring tool Zabbix could lead to full system compromise.

4 weeks ago

The Register

CVE-2024-42327

Zabbix urges upgrades after SQL injection bug disclosure

Open-source enterprise network and application monitoring provider Zabbix is warning customers of a new critical vulnerability that could lead to full system compromise. Tracked as CVE-2024-42327, the SQL...

4 weeks ago

References