CVE-2024-3455

Executive Summary

CVE-2024-3455 is a critical SQL injection vulnerability discovered in the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in the /admin/add_postlogin.php file, where the SingleLoginId parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or further compromise of the gateway appliance. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary network security appliance (Netentsec NS-ASG). Supply chain risk is limited to the vendor's firmware distribution channels.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: Low (C:L) – limited data exposure possible.
• Integrity Impact: Low (I:L) – limited data modification possible.
• Availability Impact: Low (A:L) – limited service disruption possible.

Threat Level: High due to public exploit availability and lack of patch.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the administrative interface of the NS-ASG gateway. The /admin/add_postlogin.php script is used to manage post-login settings. The SingleLoginId parameter is directly concatenated into a SQL query without proper sanitization or parameterization.

Root Cause: The application uses string concatenation to build SQL queries instead of prepared statements or parameterized queries.

Attack Vector: An attacker sends a crafted HTTP POST request to /admin/add_postlogin.php with a malicious SingleLoginId parameter containing SQL injection payloads.

Impact:

• Data Exfiltration: An attacker can extract sensitive data from the underlying database, including user credentials, configuration details, and logs.
• Authentication Bypass: By manipulating SQL queries, an attacker may bypass authentication mechanisms.
• Privilege Escalation: If the database user has sufficient privileges, the attacker could execute operating system commands via xp_cmdshell (if MSSQL) or similar functions.
• Lateral Movement: The compromised gateway could be used as a pivot point to attack internal networks.

Example Payload:

' OR '1'='1' -- 

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$id = $_POST['SingleLoginId'];
$query = "SELECT * FROM users WHERE id = '$id'";
$result = mysqli_query($conn, $query);
?>

Patched Code (Conceptual):

<?php
$id = $_POST['SingleLoginId'];
$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("s", $id);
$stmt->execute();
$result = $stmt->get_result();
?>

Patch Status: No official patch has been released by Netentsec. Users are advised to implement virtual patching via WAF rules or disable the vulnerable endpoint if possible.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: Netentsec NS-ASG 6.3 with /admin/add_postlogin.php accessible.
• Tool: sqlmap or manual exploitation.

Manual Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -X POST http://target/admin/add_postlogin.php \
        -d "SingleLoginId=1"
   

2. Test for SQL injection:

   curl -X POST http://target/admin/add_postlogin.php \
        -d "SingleLoginId=1' OR '1'='1"
   

3. Use sqlmap for automated exploitation:

   sqlmap -u "http://target/admin/add_postlogin.php" \
          --data="SingleLoginId=1" \
          --batch --dbs
   

Exploit-DB Code: None available.

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /admin/add_postlogin.php with suspicious SingleLoginId parameters.
• Look for SQL keywords (SELECT, UNION, OR, AND, --, #) in the parameter value.
• Alert on multiple failed login attempts followed by SQL injection patterns.

Honeypot:

• Deploy a decoy NS-ASG instance to capture attacker behavior.
• Log all POST requests to /admin/add_postlogin.php for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /admin/add_postlogin.php with SingleLoginId containing SQL syntax.
• Outbound database connections from the NS-ASG appliance to unexpected IPs.
• Unusual SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Modified /admin/add_postlogin.php file (if attacker uploads a webshell).
• Suspicious files in /tmp/ or /var/www/ directories.

System IOCs:

• Unexpected processes running on the appliance.
• New user accounts or modified configuration files.

Detection Engineering

YARA Rule

rule CVE_2024_3455_SQLi_NSASG {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-3455 in Netentsec NS-ASG"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3455"
    strings:
        $s1 = "SingleLoginId" ascii wide nocase
        $s2 = "add_postlogin.php" ascii wide nocase
        $sqli1 = /['\"]\s*(OR|AND)\s+['\"]?\s*['\"]?\s*=/i
        $sqli2 = /UNION\s+SELECT/i
        $sqli3 = /--\s*$/m
    condition:
        all of ($s*) and any of ($sqli*)
}

Sigma Rule

title: CVE-2024-3455 SQL Injection Attempt on NS-ASG
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the SingleLoginId parameter in /admin/add_postlogin.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3455
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/add_postlogin.php'
        cs-uri-query|contains: 'SingleLoginId'
    keywords:
        - ' OR '
        - ' AND '
        - ' UNION '
        - '--'
        - '#'
        - '1=1'
        - '1=2'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in SingleLoginId (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-3455 SQL Injection Attempt on NS-ASG";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/add_postlogin.php"; http_uri;
    content:"SingleLoginId="; http_client_body;
    pcre:"/(\x27|\x22)\s*(OR|AND)\s+/i";
    pcre:"/UNION\s+SELECT/i";
    pcre:"/--\s*$/m";
    sid:1000001;
    rev:1;
    reference:cve,2024-3455;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy WAF rules to block SQL injection patterns in the SingleLoginId parameter.
2. Endpoint Restriction: Limit access to /admin/add_postlogin.php to trusted IPs only.
3. Input Validation: Implement strict input validation for the SingleLoginId parameter (allow only alphanumeric characters).

Long-Term Fix:

• Apply the official patch from Netentsec when available.
• Upgrade to a patched firmware version.
• Replace the vulnerable appliance with a supported alternative if no patch is released.

Compensating Controls:

• Enable detailed logging and monitoring for the NS-ASG appliance.
• Implement network segmentation to isolate the gateway from critical internal systems.
• Use a database firewall to monitor and block malicious SQL queries.

Valters IT
Securing Digital Frontiers