CVE-2024-5772

Executive Summary

CVE-2024-5772 is a critical SQL injection vulnerability in the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in the /protocol/iscuser/deleteiscuser.php endpoint, where the messagecontent parameter is not sanitized before being used in a SQL query. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full system compromise. The exploit has been publicly disclosed, and no patch is available from the vendor. This vulnerability is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application) and CWE-89 (SQL Injection).

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It affects a proprietary network security appliance (Netentsec NS-ASG). No supply chain implications are present.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring. Based on the public exploit and the nature of the vulnerability, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Could lead to denial of service or system takeover.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 9.8 (Critical)

Threat Level: Critical – Public exploit available, no patch, remote unauthenticated access.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the deleteiscuser.php script. The messagecontent parameter is directly concatenated into a SQL query without proper sanitization or parameterized queries. An attacker can inject SQL commands by crafting a malicious messagecontent value.

Example vulnerable code snippet (conceptual):

$id = $_GET['messagecontent'];
$sql = "DELETE FROM users WHERE id = '$id'";
$result = mysqli_query($conn, $sql);

The attacker can break out of the string context and execute arbitrary SQL. For instance:

messagecontent=1' OR '1'='1

This would delete all users. More sophisticated payloads can extract data, create admin accounts, or execute system commands via xp_cmdshell (if MSSQL) or INTO OUTFILE (if MySQL).

Attack flow:

1. Attacker sends a crafted HTTP GET request to /protocol/iscuser/deleteiscuser.php?messagecontent=[payload].
2. The payload is injected into the SQL query.
3. The database executes the malicious SQL, returning data or performing actions.
4. Attacker receives the response (e.g., error messages, data output, or timing differences).

Vulnerable vs. Patched Code

Vulnerable code (conceptual):

$messagecontent = $_GET['messagecontent'];
$query = "DELETE FROM messages WHERE content = '$messagecontent'";
$result = mysqli_query($conn, $query);

Patched code (conceptual):

$messagecontent = $_GET['messagecontent'];
$stmt = $conn->prepare("DELETE FROM messages WHERE content = ?");
$stmt->bind_param("s", $messagecontent);
$stmt->execute();

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Target: Netentsec NS-ASG 6.3 (or any vulnerable instance).
• Attacker: Kali Linux with sqlmap and curl.

Exploitation Steps:

1. Basic injection test:

   curl "http://target/protocol/iscuser/deleteiscuser.php?messagecontent=1'"
   

   If an SQL error is returned, the endpoint is vulnerable.

2. Automated exploitation with sqlmap:

   sqlmap -u "http://target/protocol/iscuser/deleteiscuser.php?messagecontent=1" --batch --dbs
   

3. Manual data extraction:

   -- Extract database version
   messagecontent=1' UNION SELECT @@version --
   

4. Authentication bypass (if applicable):

   messagecontent=1' OR '1'='1' -- 
   

Exploit-DB Code: None provided.

Blue Team (Defender)

Detection:

• Monitor HTTP requests to /protocol/iscuser/deleteiscuser.php for unusual messagecontent parameters.
• Look for SQL keywords (SELECT, UNION, OR, AND, --, #) in the parameter value.
• Use WAF rules to block SQL injection patterns.

Hunting:

• Search logs for messagecontent containing single quotes (') or SQL comments (--, #).
• Check for error messages containing SQL syntax errors.

Mitigation:

• Immediately isolate the affected device if possible.
• Implement a virtual patch using a WAF (e.g., ModSecurity) to block SQL injection patterns.
• Contact the vendor for an official patch; if unavailable, consider replacing the device.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /protocol/iscuser/deleteiscuser.php with messagecontent containing SQL keywords.
  • Outbound database connections from the NS-ASG to unexpected IPs (data exfiltration).
  • Unusual SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

• Host IOCs:

  • Modified or deleted user records in the NS-ASG database.
  • New admin accounts created via SQL injection.
  • Suspicious files written to the web root (e.g., webshells).

• Log IOCs:

  • Web server logs showing repeated requests to the vulnerable endpoint with varying messagecontent values.
  • Database logs showing unexpected queries (e.g., UNION SELECT, xp_cmdshell).

Detection Engineering

YARA Rule

rule CVE_2024_5772_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-5772 in Netentsec NS-ASG"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5772"
    strings:
        $sqli1 = "messagecontent="
        $sqli2 = "' OR '1'='1"
        $sqli3 = "UNION SELECT"
        $sqli4 = "1' OR "
        $sqli5 = "1' AND "
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2024-5772 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Netentsec NS-ASG deleteiscuser.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "/protocol/iscuser/deleteiscuser.php?messagecontent="
        cs-uri-query|contains|all:
            - "'"
            - "OR"
            - "AND"
            - "SELECT"
            - "UNION"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in message content (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5772 SQL Injection Attempt"; flow:to_server,established; content:"/protocol/iscuser/deleteiscuser.php"; http_uri; content:"messagecontent="; http_uri; pcre:"/(\x27|%27).*(OR|AND|SELECT|UNION)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Disconnect the NS-ASG from the network if possible.
2. Apply virtual patch: Use a WAF to block requests containing SQL injection patterns in the messagecontent parameter.
3. Monitor logs: Review web and database logs for signs of exploitation.

Long-term Fix:

• Vendor patch: No patch available. Contact Netentsec for an update.
• Code fix: If source code is accessible, replace all dynamic SQL queries with prepared statements or parameterized queries.
• Replace device: Consider migrating to a supported application security gateway.

Compensating Controls:

• Implement strict input validation for all parameters.
• Use a database firewall to block suspicious queries.
• Enable detailed logging and alerting for SQL errors.

Valters IT