CVE-2024-35083

Executive Summary

CVE-2024-35083 identifies a SQL injection vulnerability in J2EEFAST v2.7.0, specifically within the findPage function in SysLoginInfoMapper.xml. This flaw allows an authenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability is classified under CWE-89 (SQL Injection) and aligns with MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). No public proof-of-concept (PoC) or patch is currently available, and the CVSS vector remains unassigned. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the potential for data breaches.

Supply Chain & Package Security

J2EEFAST is a Java-based enterprise rapid development framework. The vulnerability exists in the core persistence layer (MyBatis mapper XML), not in a third-party package. However, organizations using J2EEFAST should verify their dependency chain for any outdated or vulnerable libraries that could amplify the impact.

CVSS Breakdown & Threat Level

• CVSS Vector: UNKNOWN (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Threat Level: High. Although no public exploit exists, the vulnerability allows direct database manipulation, which can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the findPage function defined in SysLoginInfoMapper.xml. This MyBatis mapper is used to query login history records. The function likely constructs SQL queries by concatenating user-supplied input (e.g., search parameters) without proper parameterization or sanitization.

Root Cause: The findPage function uses ${} (string substitution) instead of #{} (parameterized placeholder) for certain input fields. This allows an attacker to inject SQL fragments.

Attack Scenario:

1. An attacker authenticates to the J2EEFAST application (e.g., as a low-privileged user).
2. The attacker sends a crafted HTTP request to the endpoint that invokes findPage, injecting SQL commands in a parameter (e.g., username, ip, or loginTime).
3. The injected SQL executes with the database user's privileges, potentially allowing data exfiltration, privilege escalation, or denial of service.

Example vulnerable query (conceptual):

<select id="findPage" resultType="SysLoginInfo">
  SELECT * FROM sys_login_info
  WHERE username LIKE '%${username}%'
  AND ip LIKE '%${ip}%'
</select>

Vulnerable vs. Patched Code

Vulnerable Code (v2.7.0):

<!-- SysLoginInfoMapper.xml -->
<select id="findPage" parameterType="map" resultType="com.j2eefast.modules.sys.entity.SysLoginInfoEntity">
  SELECT * FROM sys_login_info
  WHERE 1=1
  <if test="username != null and username != ''">
    AND username LIKE '%${username}%'
  </if>
  <if test="ip != null and ip != ''">
    AND ip LIKE '%${ip}%'
  </if>
  ORDER BY login_time DESC
</select>

Patched Code (hypothetical):

<!-- SysLoginInfoMapper.xml -->
<select id="findPage" parameterType="map" resultType="com.j2eefast.modules.sys.entity.SysLoginInfoEntity">
  SELECT * FROM sys_login_info
  WHERE 1=1
  <if test="username != null and username != ''">
    AND username LIKE CONCAT('%', #{username}, '%')
  </if>
  <if test="ip != null and ip != ''">
    AND ip LIKE CONCAT('%', #{ip}, '%')
  </if>
  ORDER BY login_time DESC
</select>

Key Difference: The patched version uses #{} (parameterized) and CONCAT() to safely bind user input, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a J2EEFAST v2.7.0 instance with valid credentials.
• Knowledge of the endpoint that triggers findPage (e.g., /sys/loginInfo/list).

Exploitation Steps:

1. Intercept a legitimate request to the login info listing endpoint.
2. Modify a parameter (e.g., username) to inject SQL. Example payload:

   username=admin' OR '1'='1' -- 
   

3. Observe the response for data leakage or error messages.

Advanced Payload (Time-based blind):

username=admin' AND SLEEP(5) -- 

Automated Exploitation (using sqlmap):

sqlmap -u "http://target.com/sys/loginInfo/list?username=admin" --cookie="JSESSIONID=..." --batch --risk=3 --level=5

Blue Team (Detection & Defense)

Detection Steps:

1. Monitor web server logs for unusual SQL keywords in request parameters (e.g., OR, AND, SLEEP, UNION).
2. Enable database query logging to capture all executed SQL statements.
3. Deploy a Web Application Firewall (WAF) with SQL injection signatures.

Defense Measures:

• Immediately upgrade to a patched version if available.
• Apply virtual patching via WAF rules.
• Restrict database user privileges to least privilege.
• Implement input validation and parameterized queries in all MyBatis mappers.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing SQL keywords in parameters (e.g., username=admin' OR '1'='1).
• Unusual response times (indicating time-based blind injection).
• Database error messages in HTTP responses (e.g., SQLSyntaxErrorException).

Host IOCs:

• Unexpected database queries in logs (e.g., SELECT * FROM sys_login_info WHERE username LIKE '%admin' OR '1'='1%').
• Unauthorized data exports or large result sets.

File IOCs:

• Modified SysLoginInfoMapper.xml files (if attacker attempts to patch).
• Suspicious JSP or class files uploaded via SQL injection.

Detection Engineering

YARA Rule

rule CVE_2024_35083_SQLi_J2EEFAST {
    meta:
        description = "Detects SQL injection attempts targeting J2EEFAST SysLoginInfoMapper"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-35083"
    strings:
        $s1 = "SysLoginInfoMapper" nocase
        $s2 = "findPage" nocase
        $s3 = "${" nocase
        $s4 = "username" nocase
        $s5 = "ip" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against J2EEFAST SysLoginInfoMapper
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in HTTP requests to J2EEFAST login info endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'username='
            - 'ip='
        cs-uri-query|re:
            - "'.*OR.*'"
            - "'.*AND.*'"
            - "'.*SLEEP.*'"
            - "'.*UNION.*'"
    condition: selection
falsepositives:
    - Legitimate use of special characters in usernames
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-35083 J2EEFAST SQL Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/sys/loginInfo/list"; http_uri;
    pcre:"/(username|ip)=.*('|%27).*(OR|AND|SLEEP|UNION)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-35083;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected J2EEFAST instance from untrusted networks.
2. Apply virtual patching using a WAF to block SQL injection patterns.
3. Audit all MyBatis mapper XML files for ${} usage and replace with #{}.

Long-Term Fix:

• Upgrade to a patched version of J2EEFAST once available.
• Implement a secure coding standard that mandates parameterized queries.
• Conduct regular penetration testing and code reviews.

Workaround:

• If patching is not possible, restrict access to the login info endpoint to trusted IPs only.
• Disable the findPage function by removing or commenting out the mapper XML.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert