CVE-2024-35086

Executive Summary

CVE-2024-35086 is a SQL injection vulnerability discovered in J2EEFAST v2.7.0, specifically within the findPage function in BpmTaskFromMapper.xml. This flaw allows an attacker to inject arbitrary SQL commands through unsanitized input, potentially leading to unauthorized data access, modification, or deletion. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for affected deployments.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the nature of the vulnerability (SQL injection in a web application), a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker may need low-level access to trigger the vulnerable function.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – full database read access possible.
• Integrity (I): High (H) – data modification possible.
• Availability (A): High (H) – potential for denial of service via SQL manipulation.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 8.8 (High)

Deep Dive & Mechanics

The vulnerability resides in the findPage function defined in BpmTaskFromMapper.xml. This MyBatis mapper file likely constructs dynamic SQL queries using user-supplied parameters without proper sanitization or parameterized queries. The findPage function is used for paginated data retrieval, and if input parameters such as page, limit, or filter fields are concatenated directly into the SQL statement, an attacker can inject malicious SQL.

Root Cause: Lack of input validation and use of string concatenation instead of prepared statements or parameterized queries in the MyBatis mapper.

Attack Vector: An authenticated or unauthenticated user (depending on access controls) sends a crafted HTTP request to the endpoint that invokes findPage. The injected SQL payload can extract, modify, or delete database records.

Impact: Full compromise of the underlying database, including sensitive user data, application configurations, and potential lateral movement to other systems.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is inferred:

Vulnerable (J2EEFAST v2.7.0):

<!-- BpmTaskFromMapper.xml -->
<select id="findPage" resultType="map">
    SELECT * FROM bpm_task
    WHERE status = #{status}
    AND task_name LIKE '%${searchText}%'
    ORDER BY create_time DESC
    LIMIT #{offset}, #{limit}
</select>

The ${searchText} is vulnerable to SQL injection because it is directly interpolated.

Patched (Hypothetical):

<select id="findPage" resultType="map">
    SELECT * FROM bpm_task
    WHERE status = #{status}
    AND task_name LIKE CONCAT('%', #{searchText}, '%')
    ORDER BY create_time DESC
    LIMIT #{offset}, #{limit}
</select>

Using #{searchText} ensures parameterization, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites: Access to the J2EEFAST application (e.g., http://target.com/j2eefast). The vulnerable endpoint is likely /bpmTask/findPage or similar.

Exploit Steps:

1. Identify the vulnerable parameter (e.g., searchText).
2. Craft a payload to extract data:

   GET /j2eefast/bpmTask/findPage?searchText=' UNION SELECT username,password FROM sys_user--&page=1&limit=10
   

3. Use SQLmap for automated exploitation:

   sqlmap -u "http://target.com/j2eefast/bpmTask/findPage?searchText=test&page=1&limit=10" --batch --dbs
   

No public exploit code is available.

Blue Team

Detection:

• Monitor for SQL injection patterns in HTTP requests (e.g., UNION, SELECT, OR 1=1).
• Enable database query logging to capture anomalous SQL statements.
• Use a Web Application Firewall (WAF) to block common SQLi payloads.

Mitigation:

• Immediately upgrade to a patched version if available.
• Implement input validation and parameterized queries.
• Restrict database user privileges to least privilege.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing SQL keywords in parameters (e.g., searchText=1' OR '1'='1).
• Logs: Database error logs showing syntax errors or unexpected query results.
• File: Modified or new files in the application directory (e.g., webshells).
• Behavior: Unusual database queries with high frequency or large result sets.

Detection Engineering

YARA Rule

rule CVE_2024_35086_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting J2EEFAST findPage"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35086"
    strings:
        $sqli1 = /searchText=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC)/i
        $sqli2 = /searchText=.*\b(1=1|1=2|admin'--)\b/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against J2EEFAST findPage
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection patterns in HTTP requests to J2EEFAST findPage endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'searchText='
            - 'findPage'
        cs-uri-query|re: '['\''\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC)'
    condition: selection
falsepositives:
    - Legitimate use of special characters in search terms
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35086 SQL Injection Attempt"; flow:to_server,established; content:"findPage"; http_uri; content:"searchText="; http_uri; pcre:"/searchText=.*['\''\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation and use parameterized queries in BpmTaskFromMapper.xml.
2. Short-term: Deploy a WAF with SQLi rules.
3. Long-term: Upgrade to a patched version of J2EEFAST when available.
4. Monitor: Review database logs for suspicious queries.
5. Audit: Conduct a full security audit of the application for similar vulnerabilities.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert