CVE-2024-57660

Executive Summary

CVE-2024-57660 is a denial-of-service (DoS) vulnerability in the sqlo_expand_jts component of OpenLink Virtuoso Open-Source version 7.2.11. An attacker can trigger a crash or resource exhaustion by sending specially crafted SQL statements, leading to service unavailability. No patch or exploit code is publicly available at this time. The vulnerability is classified under MITRE Tactic T1499 (Endpoint Denial of Service) and is associated with CWE-89 (SQL Injection), though the primary impact is DoS rather than data extraction.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• EPSS Score: 0.0% (Very low exploitation probability)
• Threat Level: Medium (Due to unpatched status and potential for DoS in production environments)

Deep Dive & Mechanics

The sqlo_expand_jts function in Virtuoso’s SQL engine is responsible for expanding join tree structures during query compilation. When a crafted SQL statement is provided, the function enters an infinite loop or consumes excessive memory, causing the database process to hang or crash. The vulnerability is triggered by malformed SQL that exploits improper input validation in the join expansion logic.

Root Cause: Lack of bounds checking or recursion depth limits in sqlo_expand_jts.

Attack Vector: Remote, unauthenticated (if the SQL endpoint is exposed).

Impact: Denial of service – the Virtuoso server becomes unresponsive, affecting all connected clients.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code resides in the sqlo_expand_jts function within the Virtuoso source tree. A hypothetical fix would involve adding recursion depth limits and input validation to prevent malformed join trees from causing infinite loops.

Vulnerable Code Snippet (Conceptual):

// Vulnerable: no depth check
void sqlo_expand_jts(join_tree *jt) {
    if (jt->type == COMPLEX_JOIN) {
        sqlo_expand_jts(jt->left);
        sqlo_expand_jts(jt->right);
    }
}

Patched Code Snippet (Conceptual):

#define MAX_DEPTH 100
void sqlo_expand_jts(join_tree *jt, int depth) {
    if (depth > MAX_DEPTH) {
        sql_error("Join tree too deep");
        return;
    }
    if (jt->type == COMPLEX_JOIN) {
        sqlo_expand_jts(jt->left, depth+1);
        sqlo_expand_jts(jt->right, depth+1);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Virtuoso Open-Source v7.2.11 instance with SQL query capability.
• No authentication required if the SQL endpoint is exposed.

Exploit Steps:

1. Identify the Virtuoso SQL endpoint (default port 1111 or 8890 for HTTP).
2. Send a crafted SQL statement with deeply nested joins or recursive subqueries.
3. Monitor the server for crash or unresponsiveness.

Example Payload (Conceptual):

SELECT * FROM t1 JOIN t2 ON t1.id = t2.id JOIN t3 ON t2.id = t3.id ... (repeat 1000 times)

Blue Team

Detection:

• Monitor for unusually long-running SQL queries.
• Alert on high CPU or memory usage by the virtuoso-t process.
• Use network monitoring to detect repeated malformed SQL patterns.

Mitigation:

• Restrict network access to the Virtuoso SQL port.
• Implement a Web Application Firewall (WAF) to filter suspicious SQL.
• Apply rate limiting on SQL connections.

Indicators of Compromise (IOCs)

• Network: Repeated SQL queries with excessive JOIN clauses.
• Process: virtuoso-t consuming 100% CPU or crashing.
• Logs: Error messages like "Fatal: join tree expansion failed" or "Out of memory" in Virtuoso logs.
• File: Core dumps in the Virtuoso data directory.

Detection Engineering

YARA Rule

rule CVE_2024_57660_Virtuoso_DoS {
    meta:
        description = "Detects crafted SQL payloads targeting CVE-2024-57660"
        author = "Valters IT"
        date = "2025-04-17"
    strings:
        $sql1 = /SELECT.*JOIN.*JOIN.*JOIN.*JOIN.*JOIN.*JOIN.*JOIN.*JOIN.*JOIN.*JOIN/ nocase
        $sql2 = /FROM\s+\w+\s+JOIN\s+\w+\s+ON\s+.*JOIN\s+\w+\s+ON/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-57660 Virtuoso DoS Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL queries with excessive JOIN clauses targeting Virtuoso
logsource:
    category: application
    product: virtuoso
detection:
    selection:
        Query|contains|all:
            - 'JOIN'
            - 'JOIN'
            - 'JOIN'
            - 'JOIN'
            - 'JOIN'
    condition: selection
falsepositives:
    - Legitimate complex queries
level: high

Suricata Rule

alert tcp any any -> any 1111 (msg:"CVE-2024-57660 Virtuoso DoS Attempt"; flow:to_server; content:"JOIN"; within:100; content:"JOIN"; within:100; content:"JOIN"; within:100; content:"JOIN"; within:100; content:"JOIN"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict network access to the Virtuoso SQL port (default 1111) to trusted IPs only.
2. Short-term: Monitor for unusual SQL patterns and apply rate limiting.
3. Long-term: Apply a patch when available from OpenLink. Consider upgrading to a newer version if released.
4. Workaround: Disable the sqlo_expand_jts function if not needed (requires source modification).

Valters IT
DevSecOps & Cyber Threat Intelligence