CVE-2024-0269

Executive Summary

CVE-2024-0269 is a critical authenticated SQL injection vulnerability discovered in ManageEngine ADAudit Plus, a popular Active Directory auditing and compliance solution. The flaw resides in the File-Summary DrillDown functionality and affects all versions up to and including 7270. An authenticated attacker with low privileges can exploit this vulnerability to execute arbitrary SQL commands against the backend database, potentially leading to data exfiltration, privilege escalation, or complete compromise of the ADAudit Plus server. The vendor has released version 7271 to address this issue. No public proof-of-concept (PoC) code or exploit has been released at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the low complexity of exploitation, the low privileges required, and the severe impact on confidentiality, integrity, and availability. An attacker only needs a valid low-privileged account to exploit this flaw.

Deep Dive & Mechanics

The vulnerability is an authenticated SQL injection in the File-Summary DrillDown feature of ManageEngine ADAudit Plus. This feature is used to generate detailed reports on file access and summary data. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries. An authenticated attacker can inject malicious SQL code through a crafted request to the vulnerable endpoint.

The injection likely occurs in a parameter that controls the drill-down logic, such as a file path, timestamp, or user identifier. By manipulating this parameter, an attacker can break out of the intended SQL query structure and execute arbitrary commands. This could allow the attacker to:

• Extract sensitive data from the database (e.g., user credentials, audit logs).
• Modify or delete database records.
• Execute operating system commands if the database user has sufficient privileges (e.g., xp_cmdshell in SQL Server).
• Escalate privileges within the application.

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Vulnerable vs. Patched Code

The vulnerable code likely constructs SQL queries by concatenating user input directly. For example:

Vulnerable (Version <= 7270):

String query = "SELECT * FROM FileSummary WHERE filePath = '" + request.getParameter("filePath") + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched (Version 7271):

String query = "SELECT * FROM FileSummary WHERE filePath = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, request.getParameter("filePath"));
ResultSet rs = pstmt.executeQuery();

The patched version uses parameterized queries (PreparedStatement), which prevents SQL injection by treating user input as data, not executable code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid low-privileged account on the ManageEngine ADAudit Plus instance.
• Network access to the ADAudit Plus web interface (typically port 8080 or 8443).

Exploitation Steps:

1. Authenticate to the ADAudit Plus web console.
2. Identify the vulnerable endpoint for File-Summary DrillDown. This is typically a URL like:

   /api/audit/fileSummaryDrillDown?filePath=someValue
   

3. Craft a malicious payload to inject SQL. For example, to extract the database version:

   /api/audit/fileSummaryDrillDown?filePath=' UNION SELECT @@version, NULL, NULL--
   

4. Send the request using a tool like curl or Burp Suite:

   curl -k -u "username:password" "https://target:8443/api/audit/fileSummaryDrillDown?filePath=' UNION SELECT @@version, NULL, NULL--"
   

5. Analyze the response for the injected data.

Note: Since no public PoC exists, the exact endpoint and parameter names may vary. The above is a representative example.

Blue Team

Detection Steps:

1. Monitor web server logs for unusual SQL-like patterns in request parameters (e.g., ', --, UNION, SELECT).
2. Enable database query logging to detect anomalous SQL queries.
3. Use a Web Application Firewall (WAF) to block SQL injection attempts.
4. Implement strict input validation and parameterized queries in the application.

Hunting Queries:

• Search for requests to /api/audit/fileSummaryDrillDown with parameters containing SQL keywords.
• Look for database errors in application logs (e.g., "SQL syntax error").

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/audit/fileSummaryDrillDown with parameters containing SQL injection patterns (e.g., ', --, UNION, SELECT, xp_cmdshell).
  • Unusual database error messages in HTTP responses (e.g., "Incorrect syntax near").
• Host IOCs:
  • Unexpected database queries in the ADAudit Plus database logs.
  • New or modified files in the ADAudit Plus installation directory.
  • Unusual network connections from the ADAudit Plus server to external IPs.
• File IOCs:
  • Log files containing SQL injection attempts (e.g., adap.log).

Detection Engineering

YARA Rule

rule CVE_2024_0269_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-0269 in ManageEngine ADAudit Plus"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0269"
    strings:
        $sqli1 = /fileSummaryDrillDown.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|xp_cmdshell)/i
        $sqli2 = /['\"]\s*(OR|AND)\s+['\"]\s*=/i
        $sqli3 = /--\s*$/m
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-0269 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the File-Summary DrillDown endpoint in ManageEngine ADAudit Plus
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'fileSummaryDrillDown'
            - "'"
            - '--'
            - 'UNION'
            - 'SELECT'
            - 'xp_cmdshell'
    condition: selection
falsepositives:
    - Legitimate use of special characters in file paths
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-0269 SQL Injection Attempt";
    flow:to_server,established;
    content:"fileSummaryDrillDown"; http_uri;
    pcre:"/(\x27|--|UNION|SELECT|xp_cmdshell)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Immediately upgrade ManageEngine ADAudit Plus to version 7271 or later. This is the only complete fix.
2. Workaround: If immediate patching is not possible, restrict network access to the ADAudit Plus web interface to trusted IPs only.
3. Review Accounts: Audit all user accounts and remove any unnecessary privileges.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Enforce the principle of least privilege for database accounts.
• Regularly update and patch all software.
• Conduct periodic security assessments and code reviews.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For more information, visit https://valters.it