Zabbix re-explosion high-risk SQL injection vulnerability, system permissions can be obtained

Vulnerability Overview

Zabbix is an open source enterprise-class performance monitoring solution. Recently, Zabbix's jsrpc profileIdx2 parameter has the Insert method SQL injection vulnerability, the attacker does not need to authorize the login to log on the Zabbix management system, but also can easily obtain the Zabbix server's operating system permission directly through the script and so on function.

official website

Http://www.zabbix.com

Degree of Influence

Attack Cost: Low

Hazard Level: High

Whether to login: no

Impact Range: 2.2.x, 3.0.0-3.0.3. (Other versions untested)

Vulnerability Testing

Add the following URL after your Zabbix address:

jsrpc.php?type=9&method=screen.get&timestamp=1471403798083&pagefile=history.php&profileidx= Web.item.graph&profileidx2=1+or+updatexml (1,MD5 (0x11), 1) +or+1=1)%23&updateprofile=true&period=3600 &stime=20160817050632&resourcetype=17

The output is as follows to indicate that the vulnerability exists:

Supplement

These are the only test methods for vulnerability verification.

An attacker could make a further construction statement for the wrong type of SQL injection without acquiring and cracking an encrypted administrator password.

An experienced attacker can construct a SID based on the structure algorithm directly by obtaining the SessionID of the admin, and the replacement cookie is logged directly as an administrator.

Remediation Scenarios

Upgrade to the latest version as soon as possible, it is said that 3.0.4 has been patched.

Safety Tips

Monitoring system monitors each enterprise's core assets, once hacked into control, equivalent to help hackers to further infiltrate the enterprise open the door.

Please be sure to pay attention and fix this vulnerability as soon as possible.

This article reprinted address: http://www.linuxprobe.com/zabbix-sql-bug.html

Free to provide the latest Linux technology tutorials Books, for open-source technology enthusiasts to do more and better: http://www.linuxprobe.com/

Zabbix re-explosion high-risk SQL injection vulnerability, system permissions can be obtained