CVE-2024-30864

Executive Summary

CVE-2024-30864 is a critical SQL Injection vulnerability discovered in the netentsec NS-ASG application version 6.3. The flaw resides in the /admin/config_ISCGroupTimePolicy.php endpoint, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, data manipulation, or complete compromise of the underlying database. No official patch has been released, and proof-of-concept (PoC) code is publicly available, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)
• Threat Level: Critical (based on public PoC and lack of patch)

Deep Dive & Mechanics

The vulnerability exists in the config_ISCGroupTimePolicy.php script, which is part of the NS-ASG administrative interface. The script fails to properly sanitize user-supplied input before incorporating it into SQL queries. An attacker can manipulate parameters (likely id or similar) to break out of the intended SQL syntax and execute arbitrary commands.

The injection point is likely a GET or POST parameter used to identify a group time policy. Without input validation, the attacker can append SQL keywords like UNION, OR, or AND to extract data from the database.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$id = $_GET['id'];
$query = "SELECT * FROM isc_group_time_policy WHERE id = $id";
$result = mysqli_query($conn, $query);

Patched Code (Conceptual):

$id = intval($_GET['id']);
$query = "SELECT * FROM isc_group_time_policy WHERE id = $id";
$result = mysqli_query($conn, $query);

Or using prepared statements:

$stmt = $conn->prepare("SELECT * FROM isc_group_time_policy WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();

Exploitation & Lab Setup

Red Team

Setup:

1. Deploy a vulnerable instance of NS-ASG 6.3 in an isolated lab environment.
2. Use a tool like Burp Suite or curl to interact with the target.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., id) in the URL:

   http://target/admin/config_ISCGroupTimePolicy.php?id=1
   

2. Test for SQL injection by injecting a single quote:

   http://target/admin/config_ISCGroupTimePolicy.php?id=1'
   

3. If an error is returned, confirm injection and extract data using UNION-based SQLi:

   http://target/admin/config_ISCGroupTimePolicy.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

4. Extract database names, tables, and credentials.

Blue Team

Detection:

• Monitor for abnormal SQL error messages in logs.
• Look for requests containing SQL keywords (UNION, SELECT, OR 1=1) in the id parameter.
• Use WAF rules to block suspicious patterns.

Hunting:

• Search for HTTP requests to /admin/config_ISCGroupTimePolicy.php with unusual parameter lengths or characters.
• Correlate with database error logs.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /admin/config_ISCGroupTimePolicy.php containing SQL injection patterns.
  • Outbound database connections from the web server to unexpected IPs.
• Host:
  • Unusual entries in web server access logs (e.g., id=1 UNION SELECT...).
  • Database logs showing unexpected queries or errors.
• File:
  • Modified or new files in the web root (e.g., webshells).

Detection Engineering

YARA Rule

rule CVE_2024_30864_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30864"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "/admin/config_ISCGroupTimePolicy.php" nocase
        $s2 = "id=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
        $s6 = "1=1" nocase
    condition:
        $s1 and $s2 and ($s3 or $s4 or $s5 or $s6)
}

Sigma Rule

title: CVE-2024-30864 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts against NS-ASG config_ISCGroupTimePolicy.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/admin/config_ISCGroupTimePolicy.php"
        cs-uri-query|contains|all:
            - "id="
            - "UNION"
    condition: selection
falsepositives:
    - Legitimate use of UNION in parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30864 SQL Injection Attempt"; flow:to_server,established; content:"/admin/config_ISCGroupTimePolicy.php"; http_uri; content:"id="; http_uri; content:"UNION"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or restrict access to /admin/config_ISCGroupTimePolicy.php via firewall or web server configuration.
• Short-term: Apply input validation and parameterized queries to the vulnerable script.
• Long-term: Upgrade to a patched version of NS-ASG if/when available. Implement a Web Application Firewall (WAF) with SQL injection rules.
• Compromise Assessment: If exploitation is suspected, audit database logs for unauthorized queries and check for webshells.

Report generated by Valters IT DevSecOps & CTI Division