CVE-2021-35484: Nokia IMPACT SQL Injection Vulnerability

CVE-2021-35484 Overview

CVE-2021-35484 is a Time-based Boolean Blind SQL Injection vulnerability affecting Nokia IMPACT, an IoT platform solution. The vulnerability exists in the /ui/rest-proxy/campaign/statistic endpoint used for the View Campaign page, where an authenticated user can inject malicious SQL commands through the sortColumn HTTP GET parameter. This allows attackers to extract sensitive data from the underlying database, including database user credentials, database name, and version information.

Critical Impact

An authenticated attacker can extract sensitive database information including credentials, database schema details, and potentially access to all data stored within the Nokia IMPACT platform's database.

Affected Products

• Nokia IMPACT through version 19.11.2.10-20210118042150283
• Nokia IMPACT IoT Platform (all versions prior to patched release)

Discovery Timeline

• 2026-03-03 - CVE CVE-2021-35484 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2021-35484

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) occurs within the campaign statistics functionality of the Nokia IMPACT platform. The endpoint /ui/rest-proxy/campaign/statistic accepts a sortColumn parameter via HTTP GET requests that is not properly sanitized before being incorporated into SQL queries. The vulnerability is classified as a Time-based Boolean Blind SQL Injection, meaning attackers cannot directly see the output of their injected queries but can infer information by observing the application's response times and boolean conditions.

The attack requires authentication, which limits the initial attack surface but still presents significant risk in environments where multiple users have access to the IMPACT platform. Once exploited, attackers can systematically extract database contents including sensitive IoT device information, configuration data, and administrative credentials stored within the platform.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the campaign statistics endpoint. The sortColumn parameter is directly concatenated into SQL query statements without proper sanitization or use of prepared statements. This allows attackers to inject arbitrary SQL syntax that gets executed by the database engine, bypassing intended query logic.

Attack Vector

The attack is network-based and requires the attacker to have valid authentication credentials to the Nokia IMPACT platform. Once authenticated, the attacker crafts malicious HTTP GET requests to the vulnerable endpoint, manipulating the sortColumn parameter with SQL injection payloads. Using time-based techniques, the attacker can extract data character by character by measuring response delays, or use boolean-based techniques to infer data based on conditional responses.

The attack flow typically involves:

1. Authenticating to the Nokia IMPACT platform with valid credentials
2. Accessing the campaign statistics endpoint with crafted sortColumn values
3. Using time delays or conditional responses to extract database metadata
4. Escalating to retrieve sensitive data including user credentials and database contents

Detection Methods for CVE-2021-35484

Indicators of Compromise

• Unusual or malformed requests to /ui/rest-proxy/campaign/statistic endpoint
• HTTP GET requests containing SQL syntax patterns in the sortColumn parameter (e.g., SLEEP(), WAITFOR, BENCHMARK(), AND, OR, single quotes)
• Abnormally long response times from the campaign statistics endpoint indicating time-based exploitation
• Multiple sequential requests to the same endpoint with incrementally varying parameters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the sortColumn parameter
• Configure application logging to capture and alert on requests containing SQL keywords or special characters in query parameters
• Monitor database query logs for anomalous or malformed queries originating from the IMPACT application
• Deploy intrusion detection signatures to identify time-based SQL injection attack patterns

Monitoring Recommendations

• Enable verbose logging on the Nokia IMPACT web server to capture full request details including query parameters
• Set up alerts for requests to /ui/rest-proxy/campaign/statistic with unusually long processing times
• Monitor database performance metrics for unexpected load patterns that may indicate data extraction attempts
• Audit user access logs to identify accounts making suspicious API calls to the vulnerable endpoint

How to Mitigate CVE-2021-35484

Immediate Actions Required

• Restrict access to the Nokia IMPACT platform to only essential personnel and trusted networks
• Implement network segmentation to isolate the IMPACT platform from untrusted network segments
• Enable Web Application Firewall rules specifically targeting SQL injection patterns on the affected endpoint
• Review and audit all user accounts with access to the IMPACT platform, revoking unnecessary access

Patch Information

Organizations should contact Nokia support directly to obtain the latest security patches for the IMPACT platform. Review the Nokia Responsible Disclosure Notice for guidance on security updates. Additional technical details regarding this vulnerability can be found in the Gruppo TIM security advisory.

Workarounds

• Deploy a reverse proxy or WAF in front of the Nokia IMPACT platform configured to filter SQL injection attempts
• Implement strict input validation at the network layer for requests to the /ui/rest-proxy/campaign/statistic endpoint
• Consider disabling or restricting access to the campaign statistics functionality until patches are applied
• Implement database connection monitoring to detect and block suspicious query patterns

# Example WAF rule configuration (ModSecurity)
# Block SQL injection patterns in sortColumn parameter
SecRule ARGS:sortColumn "@detectSQLi" \
    "id:10001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in sortColumn parameter - CVE-2021-35484'"