Zabbix 7.0.x < 7.0.22 / 7.2.x < 7.2.15 / 7.4.x < 7.4.6 Multiple Vulnerabilities (ZBX-27639)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(304677);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/06");

  script_cve_id("CVE-2026-23920", "CVE-2026-23921");
  script_xref(name:"IAVA", value:"2026-A-0279");

  script_name(english:"Zabbix 7.0.x < 7.0.22 / 7.2.x < 7.2.15 / 7.4.x < 7.4.6 Multiple Vulnerabilities (ZBX-27639)");

  script_set_attribute(attribute:"synopsis", value:
"A monitoring application installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Zabbix Server installed on the remote host is prior to 7.0.22, 7.2.15, 7.4.6. It is, therefore,
affected by multiple vulnerabilities :

  - A blind SQL injection vulnerability exists in the Zabbix API via the sortfield parameter in
    include/classes/api/CApiService.php. A low privilege Zabbix user with API access can exploit this to execute
    arbitrary SQL selects. Although query results are not returned directly, an attacker can exfiltrate arbitrary
    database data through time-based techniques, potentially leading to session identifier disclosure and
    administrator account compromise. (CVE-2026-23921)

  - A command injection vulnerability exists in host and event action script input validation due to the regex
    validation running in multiline mode. An authenticated, remote attacker can exploit this, via a newline
    injection, to bypass input validation and inject shell commands. (CVE-2026-23920)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  script_set_attribute(attribute:"see_also", value:"https://support.zabbix.com/browse/ZBX-27639");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Zabbix version 7.0.22, 7.2.15, 7.4.6 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-23921");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:zabbix:zabbix_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("zabbix_server_nix_installed.nbin");
  script_require_keys("installed_sw/Zabbix Server");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Zabbix Server', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'7.0.0', 'fixed_version':'7.0.22'},
        {'min_version':'7.2.0', 'fixed_version':'7.2.15'},
        {'min_version':'7.4.0', 'fixed_version':'7.4.6'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE, flags:{"sqli":TRUE});
vdf::handle_check_and_report_errors(vdf_result:result);