ZeroBox Vulnerability Database

Zabbix API使用了include/db.inc.php中定义的DBcondition()函数来执行SQL查询中WHERE子句的条件。该函数没有对用户提供数据提供额外的检查：

function DBcondition($fieldname, &$array, $notin=false, $string=false){
    global $DB;
    $condition = ”;
—[cut]—
    $in =           $notin?’ NOT IN ‘:’ IN ‘;
    $concat =       $notin?’ AND ‘:’ OR ‘;
    $glue =         $string?"’,’":’,’;

    switch($DB[‘TYPE’]) {
        case ‘SQLITE3’:
        case ‘MYSQL’:
        case ‘POSTGRESQL’:
        case ‘ORACLE’:
        default:
            $items = array_chunk($array, 950);
            foreach($items as $id => $values){
                $condition.=!empty($condition)?’)’.$concat.$fieldname.$in.'(‘:”;
                if($string)     $condition.= "’".implode($glue,$values)."’";
                else            $condition.= implode($glue,$values);
            }
            break;
    }

    if(zbx_empty($condition)) $condition = $string?"’-1’":’-1′;

return ‘ (‘.$fieldname.$in.'(‘.$condition.’)) ‘;
}

Zabbix API代码中多次使用了DBcondition()包含用户在SQL查询中所提供的参数，在class.cuser.php的认证过程中也使用了这个函数：

class CUser extends CZBXAPI{
—[cut]—
public static function get($options=array()){
—[cut]—
// users
if(!is_null($options[‘users’])){
    zbx_value2array($options[‘users’]);
    $sql_parts[‘where’][] = DBcondition(‘u.alias’, $options[‘users’],  
false, true);
}

—[cut]—
if(!empty($sql_parts[‘where’]))         $sql_where.= ‘ AND ‘.implode(‘  
AND ‘,$sql_parts[‘where’]);

—[cut]—
$sql = ‘SELECT DISTINCT ‘.$sql_select.’
                 FROM ‘.$sql_from.’
                 WHERE ‘.DBin_node(‘u.userid’, $nodeids).
                 $sql_where.
                 $sql_order;
$res = DBselect($sql, $sql_limit);
—[cut]—

从rpc/class.czbxrpc.php文件可见可以user参数调用Zabbix API的user.authenticate方式来提供$options[‘users’]变量：

// Authentication {{{
if(($resource == ‘user’) && ($action == ‘authenticate’)){
    $sessionid = null;

    $options = array(
            ‘users’ => $params[‘user’],
            ‘extendoutput’ => 1,
            ‘get_access’ => 1
            );
    $users = CUser::get($options);
    $user = reset($users);
    if($user[‘api_access’] != GROUP_API_ACCESS_ENABLED){
        self::$result = array(‘error’ => ZBX_API_ERROR_NO_AUTH, ‘data’ =>  
‘No API access’);
        return self::$result;
}

由于缺少过滤检查，用户无需认证就可以执行SQL注入攻击。

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

ZABBIX SIA
———-
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：