CVE-2024-33139

Executive Summary

CVE-2024-33139 is a critical SQL injection vulnerability discovered in J2EEFAST v2.7.0, a Java-based rapid development framework. The flaw resides in the findpage function, specifically within the sql_filter parameter, allowing unauthenticated remote attackers to inject arbitrary SQL commands. This can lead to full database compromise, data exfiltration, and potential lateral movement within the network. The vulnerability has a CVSS score of 0.0 due to incomplete NVD data, but based on the vector, it is assessed as critical. No official patch or vendor response has been identified, making all instances of J2EEFAST v2.7.0 vulnerable. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

J2EEFAST is a Java-based framework distributed via Maven Central and GitHub. The vulnerable component is part of the core framework, meaning any application built on J2EEFAST v2.7.0 inherits this vulnerability. Organizations using this framework should treat it as a supply chain risk and verify if their applications expose the findpage endpoint. No known malicious packages have been identified, but the lack of a patch increases the risk of dependency confusion or typosquatting attacks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete data.
• Availability (A): High (H) – Potential for denial of service via SQL injection.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top priority for remediation.

Deep Dive & Mechanics

The vulnerability exists in the findpage function of J2EEFAST v2.7.0, which is used for paginated database queries. The sql_filter parameter is intended to allow dynamic filtering of results, but it is directly concatenated into SQL queries without proper sanitization or parameterization.

Root Cause: The framework uses string concatenation to build SQL queries, e.g.:

String sql = "SELECT * FROM table WHERE " + sql_filter;

This allows an attacker to inject arbitrary SQL by providing a crafted sql_filter value.

Attack Vector: An HTTP GET or POST request to an endpoint that calls findpage with a malicious sql_filter parameter.

Example Payload:

GET /api/findpage?sql_filter=1=1 UNION SELECT username,password FROM users--

This would return all usernames and passwords from the users table.

Impact: Full database compromise, including extraction of sensitive data, modification of records, and potential command execution via xp_cmdshell (if SQL Server is used) or similar features.

Vulnerable vs. Patched Code

Vulnerable Code (J2EEFAST v2.7.0):

public PageResult findpage(PageParam pageParam, String sql_filter) {
    String sql = "SELECT * FROM table WHERE " + sql_filter;
    // Execute query
}

Patched Code (Hypothetical):

public PageResult findpage(PageParam pageParam, String sql_filter) {
    // Use parameterized query
    String sql = "SELECT * FROM table WHERE ?";
    PreparedStatement ps = connection.prepareStatement(sql);
    ps.setString(1, sql_filter);
    // Execute query
}

No official patch exists; the above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• J2EEFAST v2.7.0 instance running with exposed findpage endpoint.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/findpage).
2. Inject SQL via the sql_filter parameter.
3. Use UNION-based injection to extract data.

Example Exploit (Python):

import requests

target = "http://target.com/api/findpage"
payload = "1=1 UNION SELECT username,password FROM users--"
params = {"sql_filter": payload}
response = requests.get(target, params=params)
print(response.text)

Advanced Exploitation:

• Use time-based blind injection for data extraction when output is not visible.
• Leverage xp_cmdshell (if SQL Server) for OS command execution.

Blue Team

Detection:

• Monitor for unusual sql_filter parameters containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Look for requests to findpage endpoints with abnormal query strings.

Hunting:

• Search logs for sql_filter values containing ', --, UNION, or SELECT.
• Use the Sigma rule below to detect exploitation attempts.

Lab Setup:

• Deploy J2EEFAST v2.7.0 in a sandboxed environment.
• Use a web application firewall (WAF) to test detection rules.
• Simulate attacks using the provided Python script.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/findpage with sql_filter parameter containing SQL keywords.
  • Outbound database connections from the application server to unexpected IPs.
• File IOCs:
  • Log entries containing SQL injection patterns.
  • Modified database records or unexpected data exports.
• System IOCs:
  • Unusual database queries in database logs.
  • Presence of xp_cmdshell or other extended stored procedures enabled.

Detection Engineering

YARA Rule

rule CVE_2024_33139_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting J2EEFAST findpage"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33139"
    strings:
        $s1 = "sql_filter" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "AND" nocase
        $s6 = "--" nocase
        $s7 = "#" nocase
    condition:
        $s1 and (any of ($s2, $s3, $s4, $s5, $s6, $s7))
}

Sigma Rule

title: CVE-2024-33139 SQL Injection via sql_filter
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts against J2EEFAST findpage endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "sql_filter="
            - "UNION"
            - "SELECT"
            - "OR"
            - "AND"
            - "--"
            - "#"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in filters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33139 SQL Injection Attempt"; flow:to_server; content:"sql_filter"; http_uri; pcre:"/(UNION|SELECT|OR|AND|--|#)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the internet if possible.
2. Apply virtual patching using a WAF to block sql_filter parameters containing SQL keywords.
3. Disable the findpage endpoint if not required.

Long-term Fix:

• Upgrade to a patched version (none available; consider migrating to a different framework).
• Implement parameterized queries or prepared statements in all database interactions.
• Conduct a full security audit of the application.

Compensating Controls:

• Use a database firewall to monitor and block anomalous queries.
• Implement strict input validation and output encoding.
• Enable detailed logging and monitoring for all database interactions.

Valters IT
Securing Digital Frontiers