CVE-2024-53354

Executive Summary

CVE-2024-53354 is a critical SQL injection vulnerability affecting EasyVirt DCScope (<= 8.6.0) and CO2Scope (<= 1.3.0). The vulnerability allows remote authenticated attackers to execute arbitrary SQL commands through multiple parameters across various API endpoints. This can lead to complete database compromise, data exfiltration, and potential lateral movement within the network. The vendor has not released a patch, and no public proof-of-concept code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects proprietary EasyVirt software deployed on-premises.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, based on the nature of the vulnerability (authenticated SQL injection with multiple injection points), a realistic assessment would be:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Estimated CVSS Score: 8.8 (High)

Deep Dive & Mechanics

The vulnerability stems from improper sanitization of user-supplied input in multiple API endpoints. The following parameters are vulnerable to SQL injection:

• /api/management/findfilterlist – user parameter
• /api/audit/findmetawatcher – user and filter parameters
• /api/audit/findmetaalert – user parameter
• /api/management/ds – user parameter
• /api/audit/findmetarunalert – user and filter parameters
• /api/management/findtimeview – user parameter
• /api/management/getihmsettings – user, filter, and target parameters
• /api/management/elementstype – user and filter parameters
• /api/user/addalias – login, user, is_local, is_ldap, and is_openid parameters
• /api/user/addrole – role parameter
• /api/management/addtimeview – user and filter parameters
• /api/management/addtagcosts – TIMEAGO, IDENTIFIER, USER, NAME, and COST parameters
• /api/management/updategenericcpucost – USER and VM_COST parameters
• /api/management/updatecostinfo – VM, HOST, and STORAGE parameters
• /api/management/addfilter – user, filter, and timeago parameters
• /api/report/getreporthistory – user parameter

The application fails to properly escape or parameterize SQL queries, allowing an attacker to inject malicious SQL code. For example, a request to /api/management/findfilterlist?user=admin' OR '1'='1 could return all records instead of just those belonging to the specified user.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. The vulnerable code likely uses string concatenation to build SQL queries:

Vulnerable (pseudocode):

def find_filter_list(user):
    query = "SELECT * FROM filters WHERE user = '" + user + "'"
    cursor.execute(query)

Patched (pseudocode):

def find_filter_list(user):
    query = "SELECT * FROM filters WHERE user = %s"
    cursor.execute(query, (user,))

The patched version uses parameterized queries, which prevent SQL injection by separating SQL code from data.

Exploitation & Lab Setup

Red Team

Since no public exploit code is available, a penetration tester would need to craft custom SQL injection payloads. Example using sqlmap:

sqlmap -u "http://target.com/api/management/findfilterlist?user=admin" --cookie="session=valid_session_cookie" --batch --dbs

For manual testing, an attacker could use:

curl -X GET "http://target.com/api/management/findfilterlist?user=admin' UNION SELECT null,username,password,null FROM users--"

Blue Team

To simulate the attack in a lab environment:

1. Deploy EasyVirt DCScope 8.6.0 in a controlled VM.
2. Create a test user account.
3. Use Burp Suite or similar tool to intercept and modify API requests.
4. Inject SQL payloads into the vulnerable parameters.
5. Monitor logs for suspicious SQL syntax errors or unexpected database responses.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing SQL keywords (UNION, SELECT, OR, AND, --, #) in API parameters
  • Requests to multiple API endpoints in rapid succession
  • Unusual response sizes from API endpoints (indicating data exfiltration)

• Host IOCs:

  • Database logs showing unexpected queries or errors
  • Application logs with SQL syntax errors
  • New user accounts or modified roles in the application

• File IOCs:

  • Temporary files created by database dumps (e.g., /tmp/dump.sql)
  • Modified application configuration files

Detection Engineering

YARA Rule

rule CVE_2024_53354_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting EasyVirt DCScope/CO2Scope"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-53354"
    strings:
        $s1 = "/api/management/findfilterlist" nocase
        $s2 = "/api/audit/findmetawatcher" nocase
        $s3 = "/api/audit/findmetaalert" nocase
        $s4 = "/api/management/ds" nocase
        $s5 = "/api/audit/findmetarunalert" nocase
        $s6 = "/api/management/findtimeview" nocase
        $s7 = "/api/management/getihmsettings" nocase
        $s8 = "/api/management/elementstype" nocase
        $s9 = "/api/user/addalias" nocase
        $s10 = "/api/user/addrole" nocase
        $s11 = "/api/management/addtimeview" nocase
        $s12 = "/api/management/addtagcosts" nocase
        $s13 = "/api/management/updategenericcpucost" nocase
        $s14 = "/api/management/updatecostinfo" nocase
        $s15 = "/api/management/addfilter" nocase
        $s16 = "/api/report/getreporthistory" nocase
        $sqli1 = /(\%27|'|%22|\").*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
    condition:
        any of ($s*) and $sqli1
}

Sigma Rule

title: CVE-2024-53354 SQL Injection Attempt
id: cve-2024-53354-sqli
status: experimental
description: Detects SQL injection attempts against EasyVirt DCScope/CO2Scope API endpoints
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '/api/management/findfilterlist'
            - '/api/audit/findmetawatcher'
            - '/api/audit/findmetaalert'
            - '/api/management/ds'
            - '/api/audit/findmetarunalert'
            - '/api/management/findtimeview'
            - '/api/management/getihmsettings'
            - '/api/management/elementstype'
            - '/api/user/addalias'
            - '/api/user/addrole'
            - '/api/management/addtimeview'
            - '/api/management/addtagcosts'
            - '/api/management/updategenericcpucost'
            - '/api/management/updatecostinfo'
            - '/api/management/addfilter'
            - '/api/report/getreporthistory'
    keywords:
        - ' OR '
        - ' AND '
        - ' UNION '
        - ' SELECT '
        - ' INSERT '
        - ' UPDATE '
        - ' DELETE '
        - ' DROP '
        - '--'
        - '#'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in search queries
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-53354 SQL Injection Attempt";
    flow:to_server,established;
    content:"/api/"; http_uri;
    pcre:"/(findfilterlist|findmetawatcher|findmetaalert|ds|findmetarunalert|findtimeview|getihmsettings|elementstype|addalias|addrole|addtimeview|addtagcosts|updategenericcpucost|updatecostinfo|addfilter|getreporthistory)/Ri";
    pcre:"/(\%27|'|%22|\").*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    sid:10000001;
    rev:1;
    reference:cve,2024-53354;
    classtype:web-application-attack;
)

Remediation & Mitigation

Since no official patch is available, the following mitigations are recommended:

1. Immediate Actions:

   • Disable or restrict access to the vulnerable API endpoints if possible.
   • Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
   • Apply network segmentation to limit access to the EasyVirt application.

2. Long-term Solutions:

   • Contact EasyVirt for a patch or upgrade to a non-vulnerable version.
   • If source code is available, implement parameterized queries or prepared statements.
   • Conduct a full security audit of the application.

3. Monitoring:

   • Enable detailed logging for all API requests.
   • Monitor logs for SQL injection attempts using the provided detection rules.
   • Set up alerts for unusual database activity.

Valters IT