fellipefelix06

GitHub · Repository owner · Source ID 112763395
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

fellipefelix06/Zabbix-CVE-2024-42327

Repository PoC0Created 2026-05-16ExploitCVE-2024-423271 file

1.1 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to the Zabbix API, creates a script with a reverse shell command, and executes it on a target host. It does not demonstrate or exploit the SQL injection vulnerability described in CVE-2024-42327.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that uses a hardcoded API token to interact with a local Zabbix instance. It retrieves hosts, creates a script containing a reverse shell command, and executes that script on a target host. All actions are consistent with a disclosed exploit for CVE-2024-42327 (SQL injection leading to privilege escalation). No concealed, deceptive, or unrelated harmful behavior was observed.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareZabbix
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script performs authenticated API calls to create and execute a reverse shell script on a Zabbix host, which constitutes exploitation of legitimate API functionality for remote code execution. It does not contain any SQL injection payload or code to exploit the CVE-2024-42327 vulnerability.

exploit.py:1-40

Requirements

  • Valid Zabbix API token with permissions to create and execute scripts.exploit.py:3-5
  • Network access to the Zabbix frontend API endpoint.exploit.py:4

Observed behavior

  • Authenticates to the Zabbix API using a hardcoded bearer token.exploit.py:3-5
  • Retrieves a list of hosts via the host.get API method.exploit.py:13-14
  • Creates a script named 'pwn3' containing a bash reverse shell command via the script.create API method.exploit.py:26-33
  • Executes the created script on the first discovered host via the script.execute API method.exploit.py:38-39
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credential
Payload withheldA Zabbix API token is hardcoded in the script. This is a placeholder or example credential for the local target; its use is disclosed and not concealed.exploit.py:3
Reverse Shell Command
Payload withheldThe script creates a Zabbix script containing a reverse shell command targeting a placeholder IP. This is the disclosed exploit payload.exploit.py:29
Review boundaries

What the analysis did not establish

  • The script uses a hardcoded token and does not demonstrate the SQL injection vulnerability described in CVE-2024-42327.
  • The script's reverse shell payload contains a placeholder IP address (LISTEN_IP) and is not functional without modification.
  • The script does not include any exploit code for the CUser.addRelatedObjects SQL injection; it only uses legitimate Zabbix API methods.
  • The review is limited to the supplied text of exploit.py. No network traffic or runtime behavior was observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.