CVE-2024-42327

The vulnerability is located in the CUser class, in the addRelatedObjects method, which is called by the CUser.get function. The CUser.get function is available to every user with access to the API, including accounts with the default User role. Input data passed to this function is not properly validated or parameterized, which enables injection of arbitrary SQL code on the database server side.

An attacker with access to the Zabbix API can execute arbitrary SQL queries in the database, which may lead to disclosure of confidential data, data modification, and potential takeover of complete system control (privilege escalation, RCE in favorable configurations).

Patches available from the vendor should be applied in accordance with references (https://support.zabbix.com/browse/ZBX-25623). As a temporary measure, it is recommended to restrict access to the Zabbix API exclusively to trusted administrative accounts and block access to the Zabbix frontend from untrusted networks at the firewall level.

Zabbix – versions indicated in vendor references; installations are vulnerable where users with the default User role or another role with API access have the ability to use the Zabbix frontend.