CVE-2024-47911

Executive Summary

CVE-2024-47911 is a blind SQL injection vulnerability discovered in SonarQube, a widely used continuous code quality and security analysis platform. The flaw resides in the /api/authorizations/group-memberships API endpoint and affects versions 10.4 through 10.5. An authenticated attacker with the administrator role can exploit this vulnerability to inject blind SQL commands, potentially leading to unauthorized data access, modification, or privilege escalation. The vulnerability has a CVSS score of 6.7 (Medium), indicating a significant risk due to the high privileges required but the potential for severe impact. No public proof-of-concept (PoC) or exploit code has been released as of this report. The vendor, SonarSource, has addressed the issue in SonarQube version 10.6.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct vulnerability in the SonarQube application itself. Organizations using SonarQube as part of their CI/CD pipeline should treat this as a critical supply chain security issue, as a compromised SonarQube instance could lead to tampering with code quality gates and security analysis results.

CVSS Breakdown & Threat Level

• CVSS Score: 6.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): High – The attacker must have an administrator account on the SonarQube instance.
• User Interaction (UI): None – No user interaction is required.
• Scope (S): Unchanged – The exploitation does not affect other components.
• Confidentiality (C): High – Successful exploitation could lead to disclosure of sensitive data.
• Integrity (I): High – The attacker could modify or delete data.
• Availability (A): High – The attacker could disrupt the service.

Threat Level: Medium. While the CVSS score is 6.7, the requirement for administrator privileges reduces the likelihood of widespread exploitation. However, the potential impact is severe, and the vulnerability should be patched promptly.

Deep Dive & Mechanics

The vulnerability exists in the /api/authorizations/group-memberships API endpoint. This endpoint is used to manage group memberships within SonarQube. The flaw is a blind SQL injection, meaning the attacker cannot see the direct output of the injected SQL query but can infer information based on the application's response (e.g., timing or error messages).

The vulnerable code likely constructs SQL queries by concatenating user-supplied input without proper sanitization or parameterization. An attacker with administrator privileges can craft a malicious request to the endpoint, injecting SQL commands that are executed against the underlying database (typically PostgreSQL, MySQL, or MSSQL).

Blind SQL Injection Mechanics:

1. The attacker sends a request with a malicious payload in a parameter (e.g., groupName or member).
2. The application constructs a SQL query using the payload.
3. The query is executed, and the attacker observes the response time or error messages to infer the truth value of injected conditions.
4. By iterating through conditions, the attacker can extract data character by character.

Example of a vulnerable request:

POST /api/authorizations/group-memberships HTTP/1.1
Host: sonarqube.example.com
Content-Type: application/x-www-form-urlencoded

groupName=admin&member=user1' OR '1'='1

In a patched version, the input would be parameterized, preventing injection.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct string concatenation
String query = "SELECT * FROM group_memberships WHERE group_name = '" + groupName + "' AND member = '" + member + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Conceptual):

// Patched: Using parameterized queries
String query = "SELECT * FROM group_memberships WHERE group_name = ? AND member = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, groupName);
pstmt.setString(2, member);
ResultSet rs = pstmt.executeQuery();

The patched version uses PreparedStatement with parameterized queries, which ensures that user input is treated as data, not executable code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A SonarQube instance running version 10.4 or 10.5.
• Administrator credentials.

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a tool like Burp Suite or curl to interact with the /api/authorizations/group-memberships endpoint.
2. Craft a blind SQL injection payload: Use time-based or boolean-based techniques to extract data.
3. Example payload for time-based injection:

   POST /api/authorizations/group-memberships HTTP/1.1
   Host: sonarqube.example.com
   Content-Type: application/x-www-form-urlencoded
   
   groupName=admin&member=user1' OR IF(1=1, SLEEP(5), 0)--
   

4. Observe response time: If the response is delayed by 5 seconds, the injection is successful.
5. Extract data: Use conditional queries to extract database contents, such as user credentials or configuration data.

Automated Exploitation:

• Use SQLMap with the following command:

  sqlmap -u "http://sonarqube.example.com/api/authorizations/group-memberships" --data="groupName=admin&member=user1" --cookie="JSESSIONID=..." --level=5 --risk=3 --batch
  

Blue Team

Detection:

• Monitor for unusual API requests to /api/authorizations/group-memberships with suspicious parameters.
• Look for patterns such as OR, AND, SLEEP, WAITFOR, or SQL comment sequences (--, #).
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to SonarQube 10.6 or later.
• If upgrade is not possible, restrict access to the vulnerable endpoint to trusted IPs only.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual POST requests to /api/authorizations/group-memberships with parameters containing SQL keywords.
  • Anomalous response times (e.g., delays of 5 seconds or more) from the SonarQube server.
• Log IOCs:
  • SonarQube access logs showing requests with SQL-like patterns in the member or groupName parameters.
  • Database logs showing unexpected queries or errors related to the group_memberships table.
• File IOCs:
  • Modified or new files in the SonarQube installation directory (e.g., configuration files or plugins).

Detection Engineering

YARA Rule

rule CVE_2024_47911_SonarQube_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-47911 in SonarQube"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47911"
    strings:
        $sqli1 = "OR" nocase
        $sqli2 = "AND" nocase
        $sqli3 = "SLEEP" nocase
        $sqli4 = "WAITFOR" nocase
        $sqli5 = "--" nocase
        $sqli6 = "#" nocase
        $sqli7 = "UNION" nocase
        $sqli8 = "SELECT" nocase
        $sqli9 = "FROM" nocase
        $sqli10 = "WHERE" nocase
    condition:
        any of ($sqli*) and
        filesize < 10KB and
        // Look for these patterns in HTTP request bodies
        for any of ($sqli*) : ( # contains )
}

Sigma Rule

title: CVE-2024-47911 SonarQube Blind SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against the SonarQube /api/authorizations/group-memberships endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47911
logsource:
    category: webserver
    product: sonarqube
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/api/authorizations/group-memberships*'
    keywords:
        - 'OR'
        - 'AND'
        - 'SLEEP'
        - 'WAITFOR'
        - '--'
        - '#'
        - 'UNION'
        - 'SELECT'
        - 'FROM'
        - 'WHERE'
    condition: selection and keywords
falsepositives:
    - Legitimate use of these keywords in group names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-47911 SonarQube Blind SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/authorizations/group-memberships";
    http_uri;
    pcre:"/(OR|AND|SLEEP|WAITFOR|--|#|UNION|SELECT|FROM|WHERE)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2024-47911;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SonarQube: Upgrade to version 10.6 or later, which contains the fix for this vulnerability.
2. Restrict Access: If immediate upgrade is not possible, restrict access to the /api/authorizations/group-memberships endpoint to trusted IP addresses only.
3. Review Administrator Accounts: Audit all administrator accounts and ensure they follow the principle of least privilege.

Long-term Measures:

1. Input Validation: Implement strict input validation and parameterized queries for all API endpoints.
2. Web Application Firewall (WAF): Deploy a WAF with rules to block SQL injection attempts.
3. Regular Security Audits: Conduct regular security audits and penetration testing of the SonarQube instance.
4. Monitoring: Implement monitoring and alerting for suspicious API requests and database anomalies.

Patch Details:

• Vendor: SonarSource
• Fixed Version: SonarQube 10.6
• Patch URL: https://www.sonarsource.com/products/sonarqube/downloads/

Valters IT