CVE-2024-0941: Novel-Plus SQL Injection Vulnerability

CVE-2024-0941 Overview

A critical SQL injection vulnerability has been identified in Novel-Plus version 4.3.0-RC1, an open-source novel reading platform developed by xxyopen. This vulnerability exists in the file /novel/bookComment/list where improper handling of the sort parameter allows attackers to inject malicious SQL queries. The exploit details have been publicly disclosed, and the vendor was contacted but did not respond to the disclosure.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to access, modify, or delete sensitive database contents, potentially compromising user data and application integrity.

Affected Products

• xxyopen Novel-Plus 4.3.0-RC1

Discovery Timeline

• 2024-01-26 - CVE-2024-0941 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0941

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the book comment listing functionality within Novel-Plus. The application fails to properly sanitize user-supplied input in the sort parameter before incorporating it into SQL queries. This allows attackers to manipulate database queries by injecting arbitrary SQL code through the vulnerable endpoint.

The vulnerability is particularly severe because it can be exploited remotely over the network without requiring any authentication or user interaction. An attacker can leverage this flaw to extract sensitive information from the database, modify existing records, or potentially execute administrative operations depending on the database permissions configured for the application.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries in the book comment list functionality. The sort parameter is directly concatenated into SQL statements without adequate sanitization, escaping, or the use of prepared statements. This classic SQL injection pattern allows attackers to break out of the intended query structure and execute arbitrary SQL commands.

Attack Vector

The attack vector is network-based, targeting the /novel/bookComment/list endpoint. An attacker can craft malicious HTTP requests containing SQL injection payloads in the sort parameter. Since no authentication is required, any remote attacker with network access to the application can exploit this vulnerability.

The attacker manipulates the sort parameter to inject SQL syntax that alters the query's behavior. Common exploitation techniques include UNION-based injection to extract data from other tables, boolean-based blind injection to infer database contents, and time-based blind injection when direct output is not visible. Technical details of the exploitation methodology are available in the GitHub SQL Injection Guide.

Detection Methods for CVE-2024-0941

Indicators of Compromise

• Unusual or malformed requests to /novel/bookComment/list containing SQL syntax characters such as single quotes, semicolons, or SQL keywords in the sort parameter
• Database error messages appearing in application responses indicating SQL syntax errors
• Unexpected database queries or operations in database audit logs
• Large volumes of requests to the vulnerable endpoint from single IP addresses

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP parameters
• Implement application-level logging to capture all requests to the /novel/bookComment/list endpoint with full parameter values
• Configure database query logging to identify anomalous or malformed SQL statements
• Use intrusion detection systems (IDS) with SQL injection signature rules

Monitoring Recommendations

• Monitor web server access logs for requests containing SQL injection patterns targeting the sort parameter
• Set up alerts for database errors related to SQL syntax in application logs
• Track unusual data access patterns or bulk data retrieval from the database
• Monitor for authentication bypass attempts or unauthorized administrative actions

How to Mitigate CVE-2024-0941

Immediate Actions Required

• Restrict network access to the Novel-Plus application to trusted users and networks only
• Implement WAF rules to block requests containing SQL injection patterns in the sort parameter
• Consider disabling the book comment functionality temporarily until a patch is available
• Review and harden database permissions to limit the impact of potential SQL injection exploitation

Patch Information

No official patch has been released by the vendor. According to the vulnerability disclosure, xxyopen was contacted about this vulnerability but did not respond. Users should monitor the VulDB entry and the project's official channels for any future security updates.

Workarounds

• Deploy a reverse proxy or WAF with SQL injection filtering capabilities in front of the application
• Implement input validation at the application level to allow only expected values in the sort parameter (e.g., whitelist of valid column names and sort directions)
• If source code access is available, modify the vulnerable endpoint to use parameterized queries or prepared statements
• Isolate the database server and restrict its network access to only the application server

# Example WAF rule configuration (ModSecurity)
# Block SQL injection attempts in the sort parameter
SecRule ARGS:sort "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in sort parameter',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-sqli'"