CVE-2024-42327 in Zabbix
Summary
by MITRE • 11/27/2024
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/08/2025
This vulnerability resides within the Zabbix monitoring platform's web interface, specifically targeting the CUser class implementation where an SQL injection flaw exists in the addRelatedObjects function. The vulnerability is particularly concerning because it can be exploited by non-administrative users who possess the default User role or any other role that grants API access to the system. The attack vector is facilitated through the CUser.get function which serves as an entry point for malicious exploitation, making this a critical privilege escalation concern.
The technical implementation of this vulnerability stems from insufficient input validation and sanitization within the addRelatedObjects function of the CUser class. When the CUser.get function processes API requests from authenticated users, it invokes the addRelatedObjects function without proper parameter sanitization, creating an opportunity for malicious SQL payloads to be executed within the database context. This represents a classic SQL injection vulnerability that allows attackers to manipulate database queries through crafted input parameters.
The operational impact of this vulnerability extends beyond simple data exfiltration, as it enables unauthorized users to potentially access sensitive monitoring data, user credentials, and system configurations. Attackers could leverage this vulnerability to escalate privileges, access restricted API endpoints, or even gain deeper insights into the monitored infrastructure. The default User role typically has limited permissions but in this case provides sufficient access to exploit the SQL injection flaw and potentially compromise the entire monitoring platform's data integrity.
From a security framework perspective, this vulnerability aligns with CWE-89 which categorizes SQL injection flaws as critical weaknesses in application security. The ATT&CK framework would classify this as privilege escalation through application layer exploitation, potentially leading to data access and system compromise. The vulnerability demonstrates poor input validation practices and highlights the importance of implementing proper parameterized queries and access controls even for authenticated users.
Organizations should immediately implement mitigations including patching the affected Zabbix versions, implementing stricter API access controls, and monitoring for suspicious API activity patterns. Network segmentation and API rate limiting can help reduce the attack surface while administrators should conduct thorough access control reviews to ensure users have only necessary permissions. Additionally, regular security assessments of web applications should include comprehensive SQL injection testing to identify similar vulnerabilities in other components of the monitoring infrastructure.