CVE-2024-33164

Executive Summary

CVE-2024-33164 is a critical SQL injection vulnerability discovered in J2EEFAST v2.7.0, specifically within the authUserList() function. The flaw resides in the sql_filter parameter, which is not properly sanitized before being used in SQL queries. This allows an authenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a CVSS score of 0.0 in the NVD but is assessed as critical based on the impact and ease of exploitation. No official patch has been released, and no public exploit code is available, but the vulnerability is confirmed and documented.

Supply Chain & Package Security

This vulnerability affects the J2EEFAST Java-based framework, which is not distributed via NPM, PyPI, Go, or Ruby registries. It is typically deployed as a standalone WAR file or through Maven. Organizations using J2EEFAST should verify their version and apply any available security updates from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Threat Level: Critical – Exploitation is straightforward and can lead to complete database compromise.

Deep Dive & Mechanics

The authUserList() function in J2EEFAST v2.7.0 is used to retrieve a list of authorized users based on filter criteria. The sql_filter parameter is intended to allow dynamic filtering but is concatenated directly into SQL queries without proper sanitization or parameterization.

Vulnerable Code Path: The function likely constructs a SQL query similar to:

SELECT * FROM users WHERE 1=1 AND [sql_filter]

An attacker can inject SQL by providing a value like:

1=1; DROP TABLE users; --

This results in:

SELECT * FROM users WHERE 1=1 AND 1=1; DROP TABLE users; --

The injection is blind or error-based, depending on the database configuration.

Root Cause: Lack of input validation and failure to use prepared statements or parameterized queries.

Vulnerable vs. Patched Code

Vulnerable Code (J2EEFAST v2.7.0):

public List<User> authUserList(String sql_filter) {
    String sql = "SELECT * FROM users WHERE 1=1 AND " + sql_filter;
    return jdbcTemplate.query(sql, new UserRowMapper());
}

Patched Code (Hypothetical):

public List<User> authUserList(String sql_filter) {
    String sql = "SELECT * FROM users WHERE 1=1 AND ?";
    return jdbcTemplate.query(sql, new Object[]{sql_filter}, new UserRowMapper());
}

The patched version uses a parameterized query, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account on the J2EEFAST application.
• Network access to the application endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /authUserList).
2. Craft a malicious sql_filter parameter.
3. Send the request using a tool like curl or Burp Suite.

Example Request:

curl -X POST "http://target.com/authUserList" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "sql_filter=1=1 UNION SELECT username,password FROM users--"

Expected Outcome: The response will include user credentials from the database.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests containing SQL keywords (e.g., UNION, SELECT, DROP) in the sql_filter parameter.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Defense:

• Immediately upgrade to a patched version if available.
• Implement input validation and parameterized queries.
• Restrict database user permissions to limit impact.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /authUserList with sql_filter containing SQL keywords.
• Logs: Database error logs showing syntax errors or unexpected query results.
• File: Modified or deleted database records.
• Behavior: Unauthorized data access or extraction.

Detection Engineering

YARA Rule

rule CVE_2024_33164_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting J2EEFAST authUserList"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33164"
    strings:
        $sql_filter = "sql_filter=" nocase
        $sql_keywords = /(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|OR 1=1)/ nocase
    condition:
        $sql_filter and $sql_keywords
}

Sigma Rule

title: SQL Injection Attempt Against J2EEFAST authUserList
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts in the sql_filter parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "sql_filter="
        cs-uri-query|re: ".*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|OR 1=1).*"
    condition: selection
falsepositives:
    - Legitimate use of filter parameters with similar keywords
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33164 SQL Injection Attempt"; flow:to_server,established; content:"sql_filter="; http_client_body; pcre:"/(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|OR 1=1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system if possible.
2. Disable the authUserList function or restrict access to trusted IPs.
3. Apply input validation to the sql_filter parameter (whitelist allowed characters).

Long-Term Fix:

• Upgrade to a patched version of J2EEFAST once available.
• Rewrite the authUserList() function to use parameterized queries.
• Conduct a security audit of the entire codebase for similar issues.

Compensating Controls:

• Deploy a WAF with SQL injection rules.
• Enable database activity monitoring.
• Implement least privilege for database accounts.

Valters IT