CVE-2024-6456

Executive Summary

CVE-2024-6456 is a SQL injection vulnerability in AVEVA Historian Server. The flaw allows a malicious SQL command to execute under the privileges of an interactive Historian REST Interface user who has been socially engineered into opening a specially crafted URL. This attack requires user interaction (social engineering) and targets the REST API endpoint. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a server-side application vulnerability in AVEVA Historian, an industrial control system (ICS) software.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, but this is likely a placeholder. Based on the description, the attack vector is network-based (AV:N), requires user interaction (UI:R), and has high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The likely CVSS vector is: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Score 8.8 - High).

Deep Dive & Mechanics

The vulnerability exists in the AVEVA Historian REST Interface. When a user is tricked into clicking a specially crafted URL, the REST API processes the request without proper sanitization, allowing SQL injection. The injected SQL executes with the privileges of the authenticated user. This can lead to data exfiltration, modification, or denial of service.

The attack flow:

1. Attacker crafts a malicious URL containing SQL injection payload.
2. Attacker socially engineers a legitimate user to click the URL.
3. The user's browser sends the request to the Historian REST API.
4. The REST API processes the request and executes the malicious SQL.
5. The attacker gains unauthorized access to the database.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code likely involves unsanitized user input in SQL queries within the REST API handler.

Vulnerable Code (Hypothetical):

# Vulnerable REST endpoint
@app.route('/api/historian/query')
def query():
    user_input = request.args.get('query')
    sql = "SELECT * FROM data WHERE id = '" + user_input + "'"
    cursor.execute(sql)

Patched Code (Hypothetical):

# Patched REST endpoint
@app.route('/api/historian/query')
def query():
    user_input = request.args.get('query')
    sql = "SELECT * FROM data WHERE id = ?"
    cursor.execute(sql, (user_input,))

Exploitation & Lab Setup

Red Team

No public exploit code is available. For lab testing, set up an AVEVA Historian environment and craft a malicious URL with SQL injection payload.

Example URL:

http://target-server/API/endpoint?param=1' OR '1'='1

Lab Setup:

1. Install AVEVA Historian Server (vulnerable version).
2. Create a test user with REST API access.
3. Use a tool like Burp Suite to intercept and modify requests.
4. Send crafted URLs to the REST API endpoint.

Blue Team

Monitor for unusual SQL queries in database logs. Implement input validation and parameterized queries. Use web application firewalls (WAF) to block SQL injection patterns.

Detection Steps:

1. Enable detailed logging on the Historian Server.
2. Monitor for SQL error messages in logs.
3. Use network monitoring to detect suspicious URLs.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing SQL keywords (SELECT, UNION, OR, AND) in URL parameters.
• Logs: Database error logs showing SQL syntax errors or unexpected query results.
• File: No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_6456_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting AVEVA Historian REST API"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $sql1 = "SELECT" nocase
        $sql2 = "UNION" nocase
        $sql3 = "OR" nocase
        $sql4 = "AND" nocase
        $sql5 = "DROP" nocase
        $sql6 = "EXEC" nocase
    condition:
        any of ($sql*) and #sql1 > 0
}

Sigma Rule

title: CVE-2024-6456 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts in AVEVA Historian REST API logs
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'SELECT'
            - 'UNION'
            - 'OR'
            - 'AND'
            - 'DROP'
            - 'EXEC'
    condition: selection
falsepositives:
    - Legitimate queries containing these keywords
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6456 SQL Injection Attempt";
    flow:to_server,established;
    content:"SELECT"; nocase; http_uri;
    content:"UNION"; nocase; http_uri;
    content:"OR"; nocase; http_uri;
    content:"AND"; nocase; http_uri;
    content:"DROP"; nocase; http_uri;
    content:"EXEC"; nocase; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the REST API if not required. Implement input validation and parameterized queries.
2. Short-term: Apply any vendor patches when available. Use a WAF to block SQL injection patterns.
3. Long-term: Conduct a security audit of the REST API code. Implement least privilege for database accounts.
4. User Training: Educate users about social engineering attacks and not clicking suspicious URLs.

Valters IT