CVE-2024-48231

Executive Summary

CVE-2024-48231 is a critical SQL Injection vulnerability discovered in Funadmin version 5.0.2. The flaw resides in the selectFields parameter within the index method of /backend/controller/auth/Auth.php. An unauthenticated attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, data manipulation, or complete database compromise. The vulnerability is publicly known, but no official patch has been released by the vendor at this time.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a direct vulnerability in the Funadmin PHP application.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full CVSS vector has not been officially assigned. However, based on the nature of the vulnerability (SQL Injection in a backend controller), the following is a reasonable assessment:

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full database read access is likely.
• Integrity (I): High (H) - Data can be modified or deleted.
• Availability (A): High (H) - Database can be disrupted or destroyed.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection flaw in the index method of the Auth.php controller. The selectFields parameter is likely used to specify which database columns to retrieve in a query. The application fails to sanitize or parameterize this input, allowing an attacker to break out of the intended SQL syntax.

Vulnerable Code Path:

1. The index method receives a request with a selectFields parameter.
2. This parameter is directly concatenated into a SQL SELECT statement without proper escaping or prepared statements.
3. An attacker can inject SQL keywords and operators, such as UNION, OR, AND, or -- to modify the query's logic.

Example Attack Vector: An attacker could send a request like:

GET /backend/auth/index?selectFields=id,username,password FROM users--

This would modify the query to retrieve sensitive data from the users table instead of the intended data.

Vulnerable vs. Patched Code

Vulnerable Code (Funadmin 5.0.2):

// /backend/controller/auth/Auth.php
public function index() {
    $selectFields = $this->request->get('selectFields');
    $data = Db::name('auth')->field($selectFields)->select();
    return json($data);
}

Patched Code (Hypothetical):

// /backend/controller/auth/Auth.php
public function index() {
    $allowedFields = ['id', 'name', 'status']; // Whitelist
    $selectFields = $this->request->get('selectFields');
    if (!in_array($selectFields, $allowedFields)) {
        $selectFields = 'id'; // Default safe value
    }
    $data = Db::name('auth')->field($selectFields)->select();
    return json($data);
}

The patched version uses a whitelist approach to ensure only predefined, safe column names are used. Alternatively, using parameterized queries or prepared statements would also mitigate the vulnerability.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy Funadmin 5.0.2 in a controlled environment (e.g., Docker or local web server).
2. Ensure the application is accessible via a web browser.

Exploitation Steps:

1. Identify the vulnerable endpoint: /backend/auth/index.
2. Craft a malicious request to extract data. Example using curl:

   curl -X GET "http://target.com/backend/auth/index?selectFields=id,username,password FROM users--"
   

3. Use SQLMap for automated exploitation:

   sqlmap -u "http://target.com/backend/auth/index?selectFields=1" --batch --dbs
   

Expected Outcome:

• Successful extraction of database contents, including user credentials and other sensitive data.

Blue Team (Defender)

Detection & Response:

1. Monitor web server logs for unusual selectFields parameter values containing SQL keywords (e.g., UNION, SELECT, FROM, --).
2. Implement a Web Application Firewall (WAF) rule to block requests with suspicious SQL patterns in the selectFields parameter.
3. Conduct regular vulnerability scans to identify unpatched Funadmin instances.

Mitigation Steps:

• Apply input validation and parameterized queries as shown in the patched code.
• Restrict database user permissions to limit the impact of a successful injection.
• Monitor database logs for anomalous queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /backend/auth/index with a selectFields parameter containing SQL keywords.
  • Unusual database queries originating from the web server's IP address.
• File IOCs:
  • Modified or new files in the Funadmin installation directory (e.g., webshells).
• Log IOCs:
  • Web server logs showing selectFields values like id,password FROM users--.
  • Database logs showing unexpected UNION or OR operations.

Detection Engineering

YARA Rule

rule Detect_Funadmin_SQLi_CVE_2024_48231 {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-48231 in Funadmin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-48231"
    strings:
        $s1 = "selectFields" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "--" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt via selectFields Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-48231 in Funadmin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: '/backend/auth/index'
        cs-uri-query|contains: 'selectFields'
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
            - 'FROM'
    condition: selection
falsepositives:
    - Legitimate use of the selectFields parameter with safe values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48231 SQL Injection Attempt"; flow:to_server; content:"/backend/auth/index"; http_uri; content:"selectFields"; http_uri; pcre:"/(UNION|SELECT|FROM|--)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:
   • Disable the vulnerable endpoint if not required.
   • Apply input validation and parameterized queries to the selectFields parameter.
2. Long-term Fix:
   • Update to a patched version of Funadmin once available.
   • Implement a Web Application Firewall (WAF) to block SQL injection attempts.
3. Best Practices:
   • Use prepared statements for all database queries.
   • Apply the principle of least privilege to database accounts.
   • Regularly audit and review code for security vulnerabilities.

Report generated by Valters IT DevSecOps & CTI Expert System