CVE-2024-21791

Executive Summary

CVE-2024-21791 is a SQL Injection vulnerability discovered in Zoho ManageEngine ADAudit Plus, specifically within the lockout history feature. The flaw allows an authenticated attacker with non-admin privileges to inject arbitrary SQL commands, potentially leading to unauthorized data access or manipulation. The vulnerability affects versions below 7271. The CVSS score is 4.7 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept (PoC) or exploit code has been released. The vendor has addressed the issue in version 7271.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone enterprise application (Zoho ManageEngine ADAudit Plus) and does not involve a software supply chain component.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Non-admin user
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication but can be exploited by low-privileged users. The impact is limited to partial data disclosure and modification.

Deep Dive & Mechanics

The vulnerability resides in the lockout history feature of Zoho ManageEngine ADAudit Plus. The application fails to properly sanitize user-supplied input when querying the database for lockout history records. An attacker can inject SQL commands into the vulnerable parameter, bypassing intended access controls.

Root Cause: The application constructs SQL queries by concatenating user input without parameterization or proper escaping. This allows an attacker to break out of the intended query structure and execute arbitrary SQL statements.

Attack Vector: The attacker must be authenticated as a non-admin user. The vulnerable endpoint is likely a REST API or web page that accepts parameters for filtering or pagination of lockout history data.

Impact: Successful exploitation can lead to:

• Unauthorized reading of sensitive data from the database (e.g., user credentials, audit logs).
• Modification or deletion of database records.
• Potential privilege escalation if the database user has elevated permissions.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7271):

// Example of vulnerable code pattern
String query = "SELECT * FROM lockout_history WHERE user_id = '" + request.getParameter("userId") + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (7271+):

// Example of patched code using parameterized queries
String query = "SELECT * FROM lockout_history WHERE user_id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, request.getParameter("userId"));
ResultSet rs = pstmt.executeQuery();

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a vulnerable instance of Zoho ManageEngine ADAudit Plus (version < 7271).
• Valid non-admin user credentials.

Exploitation Steps:

1. Authenticate to the application as a non-admin user.
2. Identify the lockout history endpoint (e.g., /lockoutHistory?userId=...).
3. Inject SQL payload into the userId parameter:

   ' OR '1'='1' -- 
   

4. Observe the response for data leakage or error messages indicating successful injection.
5. Use UNION-based or blind SQL injection techniques to extract data:

   ' UNION SELECT null, username, password, null FROM users -- 
   

Note: No public exploit code is available. The above is a generic example.

Blue Team (Detection & Defense)

Detection:

• Monitor web application logs for unusual SQL-like patterns in request parameters (e.g., ' OR, UNION, --).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts.
• Use database activity monitoring to detect anomalous queries.

Defense:

• Immediately upgrade to version 7271 or later.
• Apply input validation and parameterized queries in all database interactions.
• Restrict database user permissions to the minimum required.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /lockoutHistory or similar endpoints containing SQL injection patterns.
  • Unusual database queries originating from the application server.
• File IOCs:
  • Modified or new files in the application directory (e.g., web shells).
• Log IOCs:
  • Application logs showing SQL errors or unexpected query results.
  • Database logs with suspicious queries (e.g., UNION SELECT).

Detection Engineering

YARA Rule

rule CVE_2024_21791_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Zoho ManageEngine ADAudit Plus lockout history"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-21791"
    strings:
        $sqli1 = /(\%27|')\s*(OR|or)\s*(\%27|')\s*(\%3D|=)/ nocase
        $sqli2 = /UNION\s+SELECT/i
        $sqli3 = /--\s*$/m
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-21791 SQL Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against Zoho ManageEngine ADAudit Plus lockout history
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "' OR '1'='1"
            - "UNION SELECT"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of special characters in queries
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-21791 SQL Injection Attempt";
    flow:to_server,established;
    content:"/lockoutHistory"; http_uri;
    pcre:"/(\%27|')\s*(OR|or)\s*(\%27|')\s*(\%3D|=)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-21791;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Zoho ManageEngine ADAudit Plus to version 7271 or later.
2. If immediate upgrade is not possible, restrict access to the lockout history feature to admin users only.
3. Apply a virtual patch via WAF to block SQL injection patterns.

Long-Term Measures:

• Implement secure coding practices, including parameterized queries and input validation.
• Conduct regular security audits and penetration testing.
• Monitor for new CVEs and apply patches promptly.

Valters IT Signature

Report generated by Valters IT DevSecOps Intelligence. For questions, contact security@valters-it.com.