Junglewise Threat Intelligence

CVE-2016-4338: Zabbix Agent command injection in mysql.size parameter

CVE-2016-4338 · Severity: high · CVSS 8.1 · Published 2017-01-23

Vendors: Zabbix.

Executive brief

Zabbix is a monitoring platform used to track the health of servers and networks. A vulnerability in the Zabbix Agent's MySQL monitoring script allows an attacker to execute unauthorized commands or database queries on the monitored system. This could lead to a full system takeover or unauthorized access to sensitive database information, particularly on systems using specific Linux configurations like Debian or Ubuntu.

Technical details

A command injection vulnerability exists in the 'mysql.size' parameter within 'userparameter_mysql.conf'. The script uses bash-specific syntax ('[[') while executing via '/bin/sh'. On systems where '/bin/sh' is linked to a non-bash shell like 'dash' (common in Debian/Ubuntu), the shell fails to interpret the brackets correctly and instead executes the first user-provided argument as a standalone command. An attacker can exploit this by sending a crafted 'mysql.size' request to the Zabbix Agent (port 10050). While Zabbix performs some input sanitization, an attacker can still execute arbitrary binaries present on the filesystem with the privileges of the Zabbix user. The vulnerability is fixed in versions 2.0.18, 2.2.13, and 3.0.3.

Affected products

  • Zabbix Zabbix Agent before 2.0.18, 2.2.x before 2.2.13, 3.0.x before 3.0.3

Timeline

  • 2016-04-21: disclosed: Reported to vendor
  • 2016-04-28: other: CVE assigned
  • 2016-05-02: advisory: Vendor published details in issue tracker
  • 2017-01-23: other: NVD publication date

References