CVE-2024-36465: Zabbix SQL Injection Vulnerability

CVE-2024-36465 Overview

CVE-2024-36465 is a SQL injection vulnerability in Zabbix, an open-source enterprise monitoring platform. The flaw resides in the include/classes/api/CApiService.php component and can be triggered by a low-privilege (regular) authenticated user with API access. Attackers manipulate the groupBy parameter to execute arbitrary SQL commands against the Zabbix backend database. The issue is tracked under Zabbix Support Issue ZBX-26257 and is categorized as [CWE-89] SQL Injection.

Critical Impact
Authenticated attackers with minimal privileges can execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the Zabbix database.

Affected Products

Zabbix (multiple versions per vendor advisory)
Zabbix 7.0.8 rc1
Deployments exposing the Zabbix API to regular authenticated users

Discovery Timeline

2025-04-02 - CVE-2024-36465 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36465

Vulnerability Analysis

The vulnerability exists in the Zabbix API service layer implemented in include/classes/api/CApiService.php. The groupBy parameter is passed into SQL statement construction without adequate sanitization or parameterization. A regular Zabbix user who can authenticate to the API can craft a malicious groupBy value that alters the intended SQL query structure. This allows the attacker to append, modify, or extend SQL clauses executed by the backend database engine.

The EPSS score is 29.26% with a percentile of 97.974, indicating a relatively high probability of exploitation activity compared to the broader CVE population. No public proof-of-concept exploit has been published at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper neutralization of user-supplied input in SQL query construction [CWE-89]. The groupBy parameter is concatenated into the SQL statement rather than bound as a parameter or validated against an allow-list of permitted column names. Any string reaching this code path from an authenticated API caller is treated as trusted SQL syntax.

Attack Vector

Exploitation requires network reachability to the Zabbix API and valid credentials for a regular (non-administrative) user. The attacker sends a crafted API request containing malicious SQL fragments in the groupBy field. The Zabbix backend then executes the resulting query against the monitoring database. Depending on database privileges, an attacker can exfiltrate credentials, monitoring data, and API tokens, or modify records used for alerting and access decisions. See the Zabbix Support Issue ZBX-26257 for vendor technical details.

Detection Methods for CVE-2024-36465

Indicators of Compromise

Zabbix API requests containing suspicious characters or SQL keywords (UNION, SELECT, --, ;) in the groupBy parameter.
Unexpected database errors logged by the Zabbix backend that reference malformed SQL near a GROUP BY clause.
API activity from low-privilege user accounts targeting endpoints that accept the groupBy parameter at abnormal volume.

Detection Strategies

Enable and review Zabbix API audit logs for requests originating from regular user accounts that include non-standard groupBy values.
Deploy a web application firewall (WAF) rule set to flag SQL metacharacters in Zabbix API request bodies.
Correlate database query logs with API request logs to identify queries that deviate from Zabbix-generated statement templates.

Monitoring Recommendations

Monitor the Zabbix database user for unexpected query patterns, especially reads against users, sessions, and configuration tables.
Alert on repeated HTTP 500 responses from Zabbix API endpoints, which often accompany SQL injection probing.
Track new or dormant Zabbix accounts that suddenly begin issuing API calls with complex query parameters.

How to Mitigate CVE-2024-36465

Immediate Actions Required

Upgrade Zabbix to a fixed version as identified in Zabbix Support Issue ZBX-26257.
Restrict Zabbix API exposure to trusted management networks and require VPN or bastion access.
Audit all Zabbix user accounts and disable or rotate credentials for accounts that are inactive or no longer required.

Patch Information

Zabbix has addressed the SQL injection flaw in include/classes/api/CApiService.php. Administrators should review the vendor advisory at Zabbix Support Issue ZBX-26257 to identify the fixed release for their branch and follow the documented upgrade procedure. Test the upgrade in a staging environment before rolling out to production monitoring servers.

Workarounds

Block or filter API requests that contain SQL metacharacters in the groupBy parameter using a reverse proxy or WAF.
Enforce least privilege on the database account used by Zabbix so that even a successful injection has limited impact on other schemas.
Restrict API access to administrator accounts only until the patch is applied, if operationally feasible.

bash

# Example nginx snippet to block obvious SQLi patterns in Zabbix API traffic
location /api_jsonrpc.php {
    if ($request_body ~* "(union[[:space:]]+select|--|;--|/\*)") {
        return 403;
    }
    proxy_pass http://zabbix_backend;
}