### #ZabbixSecurity #SQLInjectionThreat #OpenSourceRisks
Summary: A critical SQL injection vulnerability (CVE-2024-42327) has been identified in Zabbix, an open-source IT infrastructure monitoring tool, allowing attackers to escalate privileges and gain control over Zabbix instances. Organizations are urged to update to the latest patched versions to mitigate risks associated with this vulnerability.
Threat Actor: Unknown | unknown
Victim: Zabbix Users | Zabbix
Key Point :
- A critical SQL injection vulnerability (CVE-2024-42327) in Zabbix has a CVSS score of 9.9, allowing non-admin users to exploit the user.get API endpoint.
- Successful exploitation can lead to data breaches, system compromise, and denial of service, affecting sensitive monitoring data and connected systems.
- Organizations are advised to update to patched versions (6.0.32rc16, 4.17.0.1rc1) and review user permissions to limit API access.
- The vulnerability was discovered by security researcher Márk Rákóczi and reported via the HackerOne bug bounty platform.
Zabbix, a popular open-source IT infrastructure monitoring tool used by organizations worldwide, has been found to contain a critical SQL injection vulnerability (CVE-2024-42327) with a CVSS score of 9.9. This vulnerability allows attackers to escalate privileges and gain complete control of Zabbix instances, potentially compromising sensitive monitoring data and connected systems.
The vulnerability resides in the user.get API endpoint and can be exploited by any non-admin user with API access, including those with the default “User” role. By manipulating specific API calls, attackers can inject malicious SQL code that grants them unauthorized access and control.
Impact and Exploitation
Successful exploitation of CVE-2024-42327 could lead to:
- Data breaches: Attackers can access and exfiltrate sensitive monitoring data, including system configurations, performance metrics, and user credentials.
- System compromise: Attackers can leverage their escalated privileges to compromise the underlying Zabbix server and potentially pivot to other connected systems.
- Denial of service: Attackers can disrupt monitoring operations by manipulating or deleting critical data.
Mitigation and Remediation
Zabbix has addressed this vulnerability in the following versions:
- 6.0.32rc1
- 6.4.17rc1
- 7.0.1rc1
Organizations using Zabbix are strongly urged to update their deployments to the latest patched versions immediately. Additionally, it is recommended to review user roles and permissions to ensure that only authorized personnel have API access.
Vulnerability Discovery and Disclosure
The vulnerability was discovered by security researcher Márk Rákóczi and reported through the HackerOne bug bounty platform. Zabbix has acknowledged the report and promptly released patches to address the issue.
Related Posts:
Source: https://securityonline.info/cve-2024-42327-critical-sql-injection-vulnerability-found-in-zabbix