SQL Injection Vulnerability in Zabbix Package: CVE-2024-36465
Summary
DEBIAN-CVE-2024-36465: A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter. Affects zabbix versions < 1:7.0.9+dfsg-1. Fixed in 1:7.0.9+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Zabbix is an open-source monitoring software tool for networks and applications. It provides monitoring metrics, alerting, and visualization capabilities. The software is widely used for its ability to monitor various parameters of networks, servers, and applications. However, a recently identified vulnerability allows low privilege users with API access to exploit SQL injection flaws, potentially compromising the integrity of the database.
Vulnerability Detail
The vulnerability arises from an SQL injection flaw in the 'include/classes/api/CApiService.php' file of the Zabbix application. A low privilege (regular) Zabbix user can manipulate the 'groupBy' parameter to execute arbitrary SQL commands. This could lead to unauthorized access to sensitive data, data corruption, or even complete database compromise. The vulnerability is particularly concerning as it can be exploited without requiring elevated privileges, making it accessible to a broader range of users.
How To Fix
Minimum fixed version
1:7.0.9+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade zabbixTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict API access for low privilege users until the package is updated. This can be done by modifying user permissions in the Zabbix configuration settings.
Conclusion
The SQL injection vulnerability identified as CVE-2024-36465 in the Zabbix package poses significant risks to database integrity and security. It is crucial for users to update to the patched version to safeguard their systems. Additionally, implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for zabbix →
FAQ
CVE-2024-36465 is a vulnerability in the Zabbix package that allows low privilege users to exploit SQL injection flaws.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without requiring installation.
The risks include unauthorized access to sensitive data, potential data corruption, and complete database compromise.
You can update your Zabbix package by running 'sudo apt-get install zabbix=1:7.0.9+dfsg-1' in your terminal.
Yes, you can temporarily restrict API access for low privilege users until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for zabbix.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
