Zabbix < 1.8.18rc1 / 2.0.9rc1 / 2.1.7 Multiple SQL Injections - Nessus
Medium Plugin ID: 70497This page contains detailed information about the Zabbix < 1.8.18rc1 / 2.0.9rc1 / 2.1.7 Multiple SQL Injections Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.
Plugin Overview
ID: 70497
Name: Zabbix < 1.8.18rc1 / 2.0.9rc1 / 2.1.7 Multiple SQL Injections
Filename: zabbix_frontend_1_8_18rc1.nasl
Vulnerability Published: 2013-10-02
This Plugin Published: 2013-10-18
Last Modification Time: 2022-04-11
Plugin Version: 1.12
Plugin Type: remote
Plugin Family: CGI abuses
Dependencies:
zabbix_frontend_detect.nasl
Required KB Items [?]: Settings/ParanoidReport, www/zabbix
Vulnerability Information
Severity: Medium
Vulnerability Published: 2013-10-02
Patch Published: 2013-10-02
CVE [?]: CVE-2013-5743
CPE [?]: cpe:/a:zabbix:zabbix
Synopsis
The remote web application may be affected by multiple SQL injection vulnerabilities.
Description
According to its self-reported version number, the instance of Zabbix listening on the remote host is a version prior to 1.8.18rc1 / 2.0.9rc1 / 2.1.7. It is, therefore, potentially affected by multiple SQL injection vulnerabilities. The following API methods and parameters are reportedly affected :
- alert.get parameters : time_from, time_till - event.get parameters : object, source, eventid_from, eventid_till - graphitem.get parameter : type - graph.get parameters : type - graphprototype.get parameter : type - history.get parameters : time_from, time_till - trigger.get parameters : lastChangeSince, lastChangeTill, min_severity - triggerprototype.get parameter : min_severity - usergroup.get parameter : status
Additionally, code used to add objects such as graphs or maps to favorites is reportedly also affected by SQL injection attacks. The 'Dashboard', 'Graphs', 'Maps', 'Latest data', and 'Screens' pages in the 'Monitoring' section are reported to be affected.
Note that Nessus has not tested for these issues but has instead relied on the version in the Zabbix login page.
Solution
Update Zabbix to version 1.8.18rc1 / 2.0.9rc1 / 2.1.7 or later.
Public Exploits
Target Network Port(s): 80
Target Asset(s): Services/www
Exploit Available: True (Metasploit Framework, Exploit-DB, D2 Elliot)
Exploit Ease: No exploit is required
Here's the list of publicly known exploits and PoCs for verifying the Zabbix < 1.8.18rc1 / 2.0.9rc1 / 2.1.7 Multiple SQL Injections vulnerability:
- Metasploit: exploit/linux/http/zabbix_sqli
[Zabbix 2.0.8 SQL Injection and Remote Code Execution] - Exploit-DB: exploits/unix/webapps/28972.rb
[EDB-28972: Zabbix 2.0.8 - SQL Injection / Remote Code Execution (Metasploit)] - D2 Elliot: zabbix_httpmon.php_sql_injection.html
[Zabbix httpmon.php SQL Injection]
Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.
WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.
Risk Information
CVSS V2 Vector [?]: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C
CVSS Base Score: | 6.8 (Medium) |
Impact Subscore: | 6.4 |
Exploitability Subscore: | 8.6 |
CVSS Temporal Score: | 5.9 (Medium) |
CVSS Environmental Score: | NA (None) |
Modified Impact Subscore: | NA |
Overall CVSS Score: | 5.9 (Medium) |
Go back to menu.
Plugin Source
This is the zabbix_frontend_1_8_18rc1.nasl nessus plugin source code. This script is Copyright (C) 2013-2022 and is owned by Tenable, Inc. or an Affiliate thereof.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(70497);
script_version("1.12");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");
script_cve_id("CVE-2013-5743");
script_bugtraq_id(62794);
script_name(english:"Zabbix < 1.8.18rc1 / 2.0.9rc1 / 2.1.7 Multiple SQL Injections");
script_set_attribute(attribute:"synopsis", value:
"The remote web application may be affected by multiple SQL injection
vulnerabilities.");
script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the instance of Zabbix
listening on the remote host is a version prior to 1.8.18rc1 / 2.0.9rc1
/ 2.1.7. It is, therefore, potentially affected by multiple SQL
injection vulnerabilities. The following API methods and parameters are
reportedly affected :
- alert.get parameters : time_from, time_till
- event.get parameters : object, source, eventid_from, eventid_till
- graphitem.get parameter : type
- graph.get parameters : type
- graphprototype.get parameter : type
- history.get parameters : time_from, time_till
- trigger.get parameters : lastChangeSince, lastChangeTill, min_severity
- triggerprototype.get parameter : min_severity
- usergroup.get parameter : status
Additionally, code used to add objects such as graphs or maps to
favorites is reportedly also affected by SQL injection attacks. The
'Dashboard', 'Graphs', 'Maps', 'Latest data', and 'Screens' pages in the
'Monitoring' section are reported to be affected.
Note that Nessus has not tested for these issues but has instead
relied on the version in the Zabbix login page.");
# https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20131004-0_Zabbix_SQL_injection_v10.txt
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1161f5f6");
script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/archive/1/528982/30/0/threaded");
script_set_attribute(attribute:"see_also", value:"https://support.zabbix.com/browse/ZBX-7091");
script_set_attribute(attribute:"solution", value:
"Update Zabbix to version 1.8.18rc1 / 2.0.9rc1 / 2.1.7 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"d2_elliot_name", value:"Zabbix httpmon.php SQL Injection");
script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Zabbix 2.0.8 SQL Injection and Remote Code Execution');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2013/10/02");
script_set_attribute(attribute:"patch_publication_date", value:"2013/10/02");
script_set_attribute(attribute:"plugin_publication_date", value:"2013/10/18");
script_set_attribute(attribute:"potential_vulnerability", value:"true");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:zabbix:zabbix");
script_set_attribute(attribute:"thorough_tests", value:"true");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CGI abuses");
script_copyright(english:"This script is Copyright (C) 2013-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("zabbix_frontend_detect.nasl");
script_require_keys("www/zabbix", "Settings/ParanoidReport");
script_require_ports("Services/www", 80);
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");
appname = "Zabbix";
port = get_http_port(default:80, php:TRUE);
install = get_install_from_kb(appname:"zabbix", port:port, exit_on_fail:TRUE);
ver = install['ver'];
dir = install['dir'];
install_url = build_url(port:port, qs:dir);
if (ver == UNKNOWN_VER) audit(AUDIT_UNKNOWN_WEB_SERVER_VER, appname, port);
if (report_paranoia < 2) audit(AUDIT_PARANOID);
ver_split = split(ver, sep:'.', keep:FALSE);
if (max_index(ver_split) < 3) audit(AUDIT_VER_NOT_GRANULAR, appname, port, ver);
# nb : The advisory notes that all versions prior to the patched
# 1.8.18rc1 / 2.0.9rc1 / 2.1.7 are affected
if (
ver_split[0] < 1 ||
(ver_split[0] == 1 && ver_split[1] < 8) ||
ver =~ "^1\.8\.(([0-9]|1[0-7])(rc[0-9]+)?($|[^0-9]))" ||
ver =~ "^2\.0\.[0-8](rc[0-9]+)?($|[^0-9])" ||
ver =~ "^2\.1\.[0-6](rc[0-9]+)?($|[^0-9])"
)
{
set_kb_item(name:'www/'+port+'/SQLInjection', value:TRUE);
if (report_verbosity > 0)
{
report =
'\n URL : ' + install_url +
'\n Installed version : ' + ver +
'\n Fixed version : 1.8.18rc1 / 2.0.9rc1 / 2.1.7\n';
security_warning(port:port, extra:report);
}
else security_warning(port);
exit(0);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, appname, install_url, ver);
The latest version of this script can be found in these locations depending on your platform:
- Linux / Unix:
/opt/nessus/lib/nessus/plugins/zabbix_frontend_1_8_18rc1.nasl
- Windows:
C:\ProgramData\Tenable\Nessus\nessus\plugins\zabbix_frontend_1_8_18rc1.nasl
- Mac OS X:
/Library/Nessus/run/lib/nessus/plugins/zabbix_frontend_1_8_18rc1.nasl
Go back to menu.
How to Run
Here is how to run the Zabbix < 1.8.18rc1 / 2.0.9rc1 / 2.1.7 Multiple SQL Injections as a standalone plugin via the Nessus web user interface (https://localhost:8834/):
- Click to start a New Scan.
- Select Advanced Scan.
- Navigate to the Plugins tab.
- On the top right corner click to Disable All plugins.
- On the left side table select CGI abuses plugin family.
- On the right side table select Zabbix < 1.8.18rc1 / 2.0.9rc1 / 2.1.7 Multiple SQL Injections plugin ID 70497.
- Specify the target on the Settings tab and click to Save the scan.
- Run the scan.
Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.
Basic usage:
/opt/nessus/bin/nasl zabbix_frontend_1_8_18rc1.nasl -t <IP/HOST>
Run the plugin with audit trail message on the console:
/opt/nessus/bin/nasl -a zabbix_frontend_1_8_18rc1.nasl -t <IP/HOST>
Run the plugin with trace script execution written to the console (useful for debugging):
/opt/nessus/bin/nasl -T - zabbix_frontend_1_8_18rc1.nasl -t <IP/HOST>
Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):
/opt/nessus/bin/nasl -K /tmp/state zabbix_frontend_1_8_18rc1.nasl -t <IP/HOST>
Go back to menu.
References
BID | SecurityFocus Bugtraq ID: See also:
- https://www.tenable.com/plugins/nessus/70497
- https://support.zabbix.com/browse/ZBX-7091
- https://www.securityfocus.com/archive/1/528982/30/0/threaded
- http://www.nessus.org/u?1161f5f6
- https://vulners.com/nessus/ZABBIX_FRONTEND_1_8_18RC1.NASL
- 91349 - Zabbix < 2.0.18 / 2.2.13 / 3.0.3 'mysql.size' Parameter Command Injection
- 72770 - Zabbix < 1.8.20 / 2.0.11 / 2.2.2 Multiple Vulnerabilities
- 100615 - Zabbix 2.0.x < 2.0.21 / 2.2.x < 2.2.18 / 3.0.x < 3.0.9 / 3.2.x < 3.2.5 Multiple Vulnerabilities
- 158452 - Zabbix 5.4.x < 5.4.9 Multiple Vulnerabilities
- 62757 - Zabbix Web Interface popup_bitem.php itemid Parameter SQL Injection
- 35787 - Zabbix Web Interface extlang[] Parameter Remote Code Execution
- 43391 - Zabbix Server send_history_last_id() SQL Injection
- 44620 - Zabbix node_process_command() Function Crafted Request Arbitrary Command Execution
- 105042 - Zabbix Server 'active checks' Command Injection
- 139297 - Debian DLA-2311-1 : zabbix security update
- 143193 - Debian DLA-2461-1 : zabbix security update
- 148926 - Debian DLA-2631-1 : zabbix security update
- 157409 - Debian DLA-2914-1 : zabbix - LTS security update
- 62000 - Debian DSA-2539-1 : zabbix - SQL injection
- 97530 - Debian DSA-3802-1 : zabbix - security update
- 102444 - Debian DSA-3937-1 : zabbix - security update
- 57077 - Fedora 15 : zabbix-1.8.9-1.fc15 (2011-16712)
- 57078 - Fedora 16 : zabbix-1.8.9-1.fc16 (2011-16745)
- 61736 - Fedora 16 : zabbix-1.8.15-1.fc16 (2012-12488)
- 61737 - Fedora 17 : zabbix-1.8.15-1.fc17 (2012-12496)
- 73814 - Fedora 20 : zabbix-2.0.11-3.fc20 (2014-5540)
- 73815 - Fedora 19 : zabbix-2.0.11-3.fc19 (2014-5551)
- 101639 - Fedora 26 : zabbix (2017-5c8a4ebccd)
- 101181 - Fedora 25 : zabbix (2017-63aca509fb)
- 101184 - Fedora 24 : zabbix (2017-d191fb7fce)
- 139100 - Fedora 32 : 1:zabbix (2020-02cf7850ca)
- 139102 - Fedora 31 : 1:zabbix (2020-519516feec)
- 136758 - FreeBSD : Zabbix -- Remote code execution (4d11d37e-9a8d-11ea-b9b8-641c67a117d8)
- 102530 - FreeBSD : Zabbix -- Remote code execution (5df8bd95-8290-11e7-93af-005056925db4)
- 71089 - GLSA-201311-15 : Zabbix: Multiple vulnerabilities
- 95816 - GLSA-201612-42 : Zabbix: Multiple vulnerabilities
- 141167 - openSUSE Security Update : zabbix (openSUSE-2020-1604)
- 158130 - openSUSE 15 Security Update : zabbix (openSUSE-SU-2022:0036-1)
- 139658 - SUSE SLES12 Security Update : zabbix (SUSE-SU-2020:2251-1)
- 148252 - SUSE SLES12 Security Update : zabbix (SUSE-SU-2021:0990-1)
Version
This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file zabbix_frontend_1_8_18rc1.nasl version 1.12. For more plugins, visit the Nessus Plugin Library.
Go back to menu.