CVE-2024-42327

CVE-2024-42327 is a SQL injection (CWE-89) in the Zabbix frontend's CUser class, in the addRelatedObjects function, which is reached via the CUser.get API method. Any authenticated non-admin account holding the default User role, or any other role that grants API access, can trigger the flaw simply by calling user.get, with no user interaction required. The CVSS 3.1 score of 9.9 (network vector, low privileges, changed scope, high confidentiality/integrity/availability impact) indicates an attacker could read or alter database contents, potentially compromising the monitoring platform and its data beyond their own account's privileges. All Zabbix deployments whose frontends expose the API to non-admin users are affected, which is the default configuration. Exploitation has not been confirmed: the flaw is not in CISA's KEV catalog and no public PoC is known, but EPSS assigns a very high 78.7% probability of exploitation within 30 days.

What to do: Upgrade each affected Zabbix instance to the patched release for your branch as specified in Zabbix's security advisory for CVE-2024-42327. As interim mitigation, audit which non-admin users and roles have API access and restrict or disable user.get access for untrusted accounts. Monitor frontend/API logs for anomalous user.get calls and unexpected SQL activity, since exploitation requires only low-privilege API credentials.