CVE-2024-22120 (GCVE-0-2024-22120)

Vulnerability from cvelistv5 – Published: 2024-05-17 09:53 – Updated: 2024-08-01 22:35
VLAI?
Summary
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.
Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
Zabbix Zabbix Affected: 6.0.0 , ≤ 6.0.27 (git)
Affected: 6.4.0 , ≤ 6.4.12 (git)
Affected: 7.0.0alpha1 , ≤ 7.0.0beta1 (git)
Create a notification for this product.
Credits
Zabbix wants to thank Maxim Tyukov (mf0cuz) who submitted this report in HackerOne bug bounty platform
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "zabbix_server",
            "vendor": "zabbix",
            "versions": [
              {
                "status": "affected",
                "version": "6.0.0"
              },
              {
                "status": "affected",
                "version": "6.4.0"
              },
              {
                "status": "affected",
                "version": "7.0.0alpha1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22120",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T13:29:40.805103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:52:44.718Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.820Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.zabbix.com/browse/ZBX-24505"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Server"
          ],
          "product": "Zabbix",
          "repo": "https://git.zabbix.com/",
          "vendor": "Zabbix",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.0.28rc1",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.0.27",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "6.4.13rc1",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.4.12",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.0.0beta1",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.0.0beta1",
              "status": "affected",
              "version": "7.0.0alpha1",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Zabbix wants to thank Maxim Tyukov (mf0cuz) who submitted this report in HackerOne bug bounty platform"
        }
      ],
      "datePublic": "2024-05-17T08:22:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection."
            }
          ],
          "value": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-253",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-253 Remote Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-20T06:45:42.494Z",
        "orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
        "shortName": "Zabbix"
      },
      "references": [
        {
          "url": "https://support.zabbix.com/browse/ZBX-24505"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Time Based SQL Injection in Zabbix Server Audit Log",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
    "assignerShortName": "Zabbix",
    "cveId": "CVE-2024-22120",
    "datePublished": "2024-05-17T09:53:52.798Z",
    "dateReserved": "2024-01-05T07:44:01.395Z",
    "dateUpdated": "2024-08-01T22:35:34.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \\\"Audit Log\\\". Due to \\\"clientip\\\" field is not sanitized, it is possible to injection SQL into \\\"clientip\\\" and exploit time based blind SQL injection.\"}, {\"lang\": \"es\", \"value\": \"El servidor Zabbix puede realizar la ejecuci\\u00f3n de comandos para scripts configurados. Despu\\u00e9s de ejecutar el comando, la entrada de auditor\\u00eda se agrega al \\\"Registro de auditor\\u00eda\\\". Debido a que el campo \\\"clientip\\\" no est\\u00e1 sanitizado, es posible inyectar SQL en \\\"clientip\\\" y explotar la inyecci\\u00f3n SQL ciega basada en el tiempo.\"}]",
      "id": "CVE-2024-22120",
      "lastModified": "2024-11-21T08:55:37.330",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@zabbix.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 6.0}]}",
      "published": "2024-05-17T10:15:07.363",
      "references": "[{\"url\": \"https://support.zabbix.com/browse/ZBX-24505\", \"source\": \"security@zabbix.com\"}, {\"url\": \"https://support.zabbix.com/browse/ZBX-24505\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@zabbix.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security@zabbix.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-22120\",\"sourceIdentifier\":\"security@zabbix.com\",\"published\":\"2024-05-17T10:15:07.363\",\"lastModified\":\"2025-10-08T15:57:03.240\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \\\"Audit Log\\\". Due to \\\"clientip\\\" field is not sanitized, it is possible to injection SQL into \\\"clientip\\\" and exploit time based blind SQL injection.\"},{\"lang\":\"es\",\"value\":\"El servidor Zabbix puede realizar la ejecuci\u00f3n de comandos para scripts configurados. Despu\u00e9s de ejecutar el comando, la entrada de auditor\u00eda se agrega al \\\"Registro de auditor\u00eda\\\". Debido a que el campo \\\"clientip\\\" no est\u00e1 sanitizado, es posible inyectar SQL en \\\"clientip\\\" y explotar la inyecci\u00f3n SQL ciega basada en el tiempo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@zabbix.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@zabbix.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.28\",\"matchCriteriaId\":\"D724C8AD-C793-4602-8B1B-33B54A0A847A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.0\",\"versionEndExcluding\":\"6.4.13\",\"matchCriteriaId\":\"8507A896-08E2-4A4F-B499-66BDA79CAA32\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"93EB5757-7F98-4428-9616-C30A647A6612\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA00BDB5-433F-44E5-87AC-DA01C64B5DB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"98C46C92-9D86-45CD-88FE-DFBB5502BB88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"B568E6DD-A6D1-4402-BB40-7DA2596A5BC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9C3673B-8459-4C63-8E90-724D1D42A8BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C9F6957-7526-4852-A579-DE556DBFAA97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*\",\"matchCriteriaId\":\"81A7A191-93DE-4C5D-963E-E8890FF7AACA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEE202D5-3C88-43A5-9328-FC78D0B9B8CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*\",\"matchCriteriaId\":\"F88BFB75-7951-47D5-941F-3839E9E31FFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8216247E-C160-4D2C-906E-9D8CD731B5C2\"}]}]}],\"references\":[{\"url\":\"https://support.zabbix.com/browse/ZBX-24505\",\"source\":\"security@zabbix.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://support.zabbix.com/browse/ZBX-24505\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://support.zabbix.com/browse/ZBX-24505\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T22:35:34.820Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-22120\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T13:29:40.805103Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:*\"], \"vendor\": \"zabbix\", \"product\": \"zabbix_server\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0.0\"}, {\"status\": \"affected\", \"version\": \"6.4.0\"}, {\"status\": \"affected\", \"version\": \"7.0.0alpha1\"}], \"defaultStatus\": \"affected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-20T13:30:37.964Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"Time Based SQL Injection in Zabbix Server Audit Log\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Zabbix wants to thank Maxim Tyukov (mf0cuz) who submitted this report in HackerOne bug bounty platform\"}], \"impacts\": [{\"capecId\": \"CAPEC-253\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-253 Remote Code Inclusion\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://git.zabbix.com/\", \"vendor\": \"Zabbix\", \"modules\": [\"Server\"], \"product\": \"Zabbix\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"6.0.28rc1\", \"status\": \"unaffected\"}], \"version\": \"6.0.0\", \"versionType\": \"git\", \"lessThanOrEqual\": \"6.0.27\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.4.13rc1\", \"status\": \"unaffected\"}], \"version\": \"6.4.0\", \"versionType\": \"git\", \"lessThanOrEqual\": \"6.4.12\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"7.0.0beta1\", \"status\": \"unaffected\"}], \"version\": \"7.0.0alpha1\", \"versionType\": \"git\", \"lessThanOrEqual\": \"7.0.0beta1\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2024-05-17T08:22:00.000Z\", \"references\": [{\"url\": \"https://support.zabbix.com/browse/ZBX-24505\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \\\"Audit Log\\\". Due to \\\"clientip\\\" field is not sanitized, it is possible to injection SQL into \\\"clientip\\\" and exploit time based blind SQL injection.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \\\"Audit Log\\\". Due to \\\"clientip\\\" field is not sanitized, it is possible to injection SQL into \\\"clientip\\\" and exploit time based blind SQL injection.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"72de3e22-0555-4a0d-ae81-9249e0f0a1e8\", \"shortName\": \"Zabbix\", \"dateUpdated\": \"2024-05-20T06:45:42.494Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-22120\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T22:35:34.820Z\", \"dateReserved\": \"2024-01-05T07:44:01.395Z\", \"assignerOrgId\": \"72de3e22-0555-4a0d-ae81-9249e0f0a1e8\", \"datePublished\": \"2024-05-17T09:53:52.798Z\", \"assignerShortName\": \"Zabbix\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.