[ZBX-13781] CRLF Injection in Zabbix Agentd Created: 2018 Feb 27  Updated: 2024 Apr 10  Resolved: 2018 Apr 27

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 2.2.20, 2.2.21, 3.0.15, 3.4.7
Fix Version/s: 2.2.22rc1, 3.0.17rc1, 3.0.17rc2, 3.4.9rc1, 3.4.9rc2, 4.0.0alpha6, 4.0 (plan)

Type: Problem report Priority: Critical
Reporter: Nguyen Tien Giang Assignee: Michael Veksler
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

All

Attachments: PNG File z2.PNG     PNG File z3.PNG    
Issue Links:
Causes
causes ZBX-15971 Items using: "web.page.*" switch to u... Closed
Team: Team C
Team: Team C
Sprint: Sprint 31, Sprint 32
Story Points: 0.5

 Description   

The problem happen in the item "web.page.get[]", which used to "get content of the http web page".
The function handles this item is "get_http_page()" in /libs/zbxsysinfo/common/http.c.
When building the request for http connection, no secure check was made for the parameter in line 41: (see image below).
Attacker can add CRLF character to the "path" parameter and freely control the request! (see image below
It can be abused, and used to make tcp request to any local port of the server using zabbix agentd.
For example: Some server using redis, memcached, ... attacker can connect to this port and control it to write file, code execution ...
I don't know this is intent or not but I think it should not be there!

 Comments   
Comment by Glebs Ivanovskis (Inactive) [ 2018 Feb 27 ]

Dear testanull, thank you for the report! Since it is a security-related issue, I will move the ticket to the internal project while we work on the fix so that the vulnerability cannot be exploited. Ticket will be moved back when a version with the fix is released. Hopefully you will get an email about this comment.

Comment by Glebs Ivanovskis (Inactive) [ 2018 Apr 21 ]

We are planning to release the fixed version on Monday. I suggest you wait until release, ticket was moved into public ZBX project a bit too early.

Comment by Michael Veksler [ 2018 Apr 27 ]

Available in:

  • branch 2.2.22rc1 r80272.
  • branch 3.0.17rc2 r80268.
  • branch 3.4.9rc2 r80269.
  • pre-4.0.0alpha6 (trunk) r80270.
Generated at Sat Apr 20 09:47:02 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.