CVE-2024-42327 SQL injection in user.get API

What is CVE-2024-42327?

CVE-2024-42327 is a critical SQL injection vulnerability in Zabbix Zabbix, published on 27 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

Weakness: CWE-89

Which versions are affected by CVE-2024-42327?

It affects 1 product.

Products include Zabbix Zabbix.

How do I fix CVE-2024-42327?

Apply the vendor's patch.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-42327 being exploited?

There is no known exploitation of CVE-2024-42327 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 11 proofs of concept on GitHub.

Other vulnerabilities in Zabbix Zabbix

• CVE-2022-23131 Zabbix Frontend Authentication Bypass Exploited Critical 9.1
• CVE-2007-0640 Memory corruption in n/a Critical 10.0
• CVE-2024-22116 Remote code execution within ping script Critical 9.9
• CVE-2013-3738 Code injection in n/a Critical 9.8
• CVE-2013-5743 SQL injection in n/a Critical 9.8

All Zabbix Zabbix vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2024-42327, GHSA-gx59-7g62-6xhg, UBUNTU-CVE-2024-42327.