compr00t/CVE-2024-42327

GitHubRepository PoC

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

infrastructure/compose.yaml

Created Vuln labCVE-2024-42327Compose · images

1 Compose manifest · 11 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a Zabbix monitoring stack with server, proxies, web frontends, agent, Java gateway, SNMP traps, web service, and MySQL database. The README describes a proof-of-concept for CVE-2024-42327, an SQL injection in the Zabbix frontend API.

infrastructure/compose.yaml:1-158README.md:1-44

Lab assessment

Vulnerability lab

The README explicitly states it is a PoC for CVE-2024-42327, provides vulnerable code and a curl request to trigger the SQLi, and the Compose file sets up a Zabbix 6.0.31 environment matching the vulnerable version.

README.md:1-2README.md:9-10infrastructure/compose.yaml:47-48
Lab shapeCompose · images
Services11
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

zabbix-server

Zabbix server (MySQL backend)

Core Zabbix server using MySQL, depends on mysql-server, mounts host /etc/timezone.

infrastructure/compose.yaml:2-10

zabbix-proxy-sqlite3

Zabbix proxy (SQLite3 backend)

Zabbix proxy with SQLite3 storage, mounts host /etc/timezone.

infrastructure/compose.yaml:12-18

zabbix-proxy-mysql

Zabbix proxy (MySQL backend)

Zabbix proxy with MySQL storage, depends on mysql-server, mounts host /etc/timezone.

infrastructure/compose.yaml:20-28

zabbix-web-apache-mysql

Zabbix web frontend (Apache, MySQL)

Zabbix web interface using Apache and MySQL, depends on mysql-server, mounts host /etc/timezone.

infrastructure/compose.yaml:30-38

zabbix-web-nginx-mysql

Zabbix web frontend (Nginx, MySQL, version 6.0.31)

Zabbix web interface using Nginx and MySQL, pinned to image zabbix/zabbix-web-nginx-mysql:6.0.31-alpine, depends on mysql-server, mounts host /etc/timezone. This is the vulnerable component targeted by the PoC.

infrastructure/compose.yaml:40-48README.md:9-10

zabbix-agent

Zabbix agent

Zabbix agent for monitoring, mounts host /etc/timezone.

infrastructure/compose.yaml:50-56

zabbix-java-gateway

Zabbix Java gateway

Gateway for monitoring Java applications via JMX.

infrastructure/compose.yaml:58-63

zabbix-snmptraps

Zabbix SNMP trap receiver

Receives SNMP traps.

infrastructure/compose.yaml:65-70

zabbix-web-service

Zabbix web service

Zabbix web service for scheduled reporting and other functions.

infrastructure/compose.yaml:72-77

mysql-server

MySQL database server

MySQL database for Zabbix server and proxies, defined in external compose_databases.yaml.

infrastructure/compose.yaml:79-81

db-data-mysql

MySQL data volume container

Data volume for MySQL, defined in external compose_databases.yaml.

infrastructure/compose.yaml:83-85
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-42327

Supported by supplied evidence

The README explicitly states the PoC is for CVE-2024-42327, provides vulnerable code from version 6.0.31, and the Compose file pins the web frontend to image zabbix/zabbix-web-nginx-mysql:6.0.31-alpine, matching the vulnerable version.

README.md:1-2README.md:9-10infrastructure/compose.yaml:47-48
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A non-admin user account on the Zabbix frontend with the default User role or any role that gives API access.README.md:2
  • The Zabbix frontend must be running and accessible (e.g., via the zabbix-web-nginx-mysql service).infrastructure/compose.yaml:40-48
  • The attacker must obtain a valid API authentication token (auth field in the JSON-RPC request).README.md:30

Evidence-described exercise path

  1. Start the Zabbix environment using the provided Compose file.infrastructure/compose.yaml:1-158
  2. Obtain a valid API authentication token for a non-admin user.README.md:2
  3. Send the provided JSON-RPC request to /api_jsonrpc.php with the SQL injection payload in the selectRole parameter.README.md:20-33
  4. Observe the time-based SQL injection effect (SLEEP(5)) to confirm the vulnerability.README.md:28
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Compose file defines a standard Zabbix stack with no privileged mode, no host path mounts beyond /etc/timezone (read-only), no port mappings exposing services externally, and no suspicious commands. The README describes a contained SQL injection PoC targeting the lab's own Zabbix frontend. No evidence of host escape, external connectivity, persistence, credential theft, or destructive behavior is present.

infrastructure/compose.yaml:1-158README.md:1-44
Review boundaries

What the analysis did not establish

  • Missing referenced Compose files compose_databases.yaml and compose_zabbix_components.yaml; their contents are uninspected.
  • The Compose file uses many environment variables whose values are unknown; the actual runtime configuration may differ.
  • No Dockerfiles are present; container images are pulled from Docker Hub and their contents are uninspected.
  • The README provides only a curl request; no exploit script or additional tooling is included in the packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1