CVE-2024-43415

Executive Summary

CVE-2024-43415 is a critical SQL Injection vulnerability discovered in the decidim_awesome module, specifically within the papertrail/version model. The flaw affects versions greater than 0.9.0 and up to and including 0.11.1. An authenticated admin user can exploit improper neutralization of special elements used in an SQL command to manipulate queries, leading to information disclosure, file read/write, and potential remote command execution. The CVSS score of 9.0 underscores the severity, though exploitation requires administrative privileges. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

This vulnerability resides in the decidim_awesome Ruby gem, which is a third-party module for the Decidim participatory democracy framework. Organizations using Decidim with this module are at risk. The supply chain risk is elevated because the module is not part of the core Decidim distribution, and patch status remains unknown. Administrators should monitor the official repository for updates and consider removing or disabling the module until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond authentication.
• Privileges Required (PR): High (H) – An admin account is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full database and file system access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Service disruption is possible.

Threat Level: Critical. Despite requiring admin privileges, the potential for complete system compromise makes this a high-priority vulnerability.

Deep Dive & Mechanics

The vulnerability exists in the papertrail/version model of the decidim_awesome module. The papertrail gem is used for auditing changes to models, and the decidim_awesome module extends its functionality. The flaw lies in how user-supplied input is handled when querying version records. Specifically, the module fails to properly sanitize special characters used in SQL commands, allowing an authenticated admin to inject arbitrary SQL.

The injection point is likely in a search or filter parameter that is passed directly to a where clause or similar SQL method. Because the admin user has elevated privileges, they can craft requests that bypass normal input validation. The impact includes:

• Information Disclosure: Dumping the entire database, including user credentials and sensitive data.
• File Read/Write: Using database functions like LOAD_FILE or INTO OUTFILE to read/write files on the server.
• Command Execution: In some database configurations, SQL injection can lead to OS command execution via extended procedures or user-defined functions.

Vulnerable vs. Patched Code

Since no official patch has been released, a comparison is based on the vulnerable code pattern. The vulnerable code likely resembles:

# Vulnerable code (decidim_awesome <= 0.11.1)
def search_versions(query)
  Version.where("resource_type = ? AND resource_id IN (#{query})", params[:resource_type])
end

A patched version would use parameterized queries or prepared statements:

# Patched code (hypothetical)
def search_versions(query)
  Version.where("resource_type = ? AND resource_id IN (?)", params[:resource_type], query.split(','))
end

The key difference is that the vulnerable code concatenates user input directly into the SQL string, while the patched version uses placeholders and passes the input as a parameter.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for a Decidim instance with decidim_awesome v0.11.1.
• Network access to the Decidim web interface.

Exploitation Steps:

1. Log in as an admin user.
2. Navigate to a page that uses the papertrail/version model (e.g., audit log or version history).
3. Intercept the request with a proxy like Burp Suite.
4. Identify the vulnerable parameter (e.g., q, search, or version_id).
5. Inject a SQL payload. Example for MySQL:

   ' UNION SELECT 1,2,3,4,5,@@version,7,8,9 --
   

6. Observe the response for database version disclosure.
7. Escalate to file read:

   ' UNION SELECT LOAD_FILE('/etc/passwd'),2,3,4,5,6,7,8,9 --
   

8. For command execution (if MySQL has sys_exec or similar):

   '; EXEC xp_cmdshell('whoami'); --
   

Note: No public exploit code is available, so this is a theoretical approach.

Blue Team

Detection:

• Monitor for SQL error messages in application logs (e.g., Mysql2::Error, SQLite3::SQLException).
• Look for unusual SQL keywords in HTTP request parameters (e.g., UNION, SELECT, LOAD_FILE).
• Alert on admin users making requests to version history endpoints with abnormal query strings.

Hunting:

• Search logs for requests to /admin/versions or similar paths with parameters containing SQL syntax.
• Correlate with database query logs for unexpected SELECT or UNION statements.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /admin/versions or /papertrail/versions with parameters containing SQL keywords.
• Logs: Application logs showing SQLException or Mysql2::Error with stack traces.
• File System: Unexpected files in the web root (e.g., /tmp/exploit.txt) created via INTO OUTFILE.
• Database: New database users or altered permissions.

Detection Engineering

YARA Rule

rule Detect_Decidim_Awesome_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting decidim_awesome papertrail/version model"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-43415"
    strings:
        $s1 = "papertrail/version" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "LOAD_FILE" nocase
        $s5 = "INTO OUTFILE" nocase
    condition:
        all of ($s1, $s2, $s3) or all of ($s1, $s4) or all of ($s1, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against Decidim Awesome
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting the papertrail/version model in decidim_awesome
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'UNION'
            - 'SELECT'
            - 'LOAD_FILE'
            - 'INTO OUTFILE'
        cs-uri-stem|contains:
            - '/admin/versions'
            - '/papertrail/versions'
    condition: selection
falsepositives:
    - Legitimate admin searches with similar keywords (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43415 SQL Injection Attempt"; flow:to_server,established; content:"/admin/versions"; http_uri; content:"UNION"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-43415 File Read Attempt"; flow:to_server,established; content:"/admin/versions"; http_uri; content:"LOAD_FILE"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-43415 File Write Attempt"; flow:to_server,established; content:"/admin/versions"; http_uri; content:"INTO OUTFILE"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the decidim_awesome module if not critical to operations.
2. Restrict admin access to only trusted users and enforce strong authentication.
3. Apply Web Application Firewall (WAF) rules to block SQL injection patterns.

Long-term Fix:

• Monitor the official decidim_awesome repository for a patched version.
• Once available, upgrade to the latest version immediately.
• Conduct a code review of the papertrail/version model to ensure parameterized queries are used.

Workaround:

• If the module cannot be disabled, implement input validation in a reverse proxy to sanitize parameters before they reach the application.

Valters IT