CVE-2024-2620: Kelixin Command Platform SQLi Vulnerability

CVE-2024-2620 Overview

A critical SQL injection vulnerability has been identified in Fujian Kelixin Communication Command and Dispatch Platform versions up to 20240318. This vulnerability affects the file api/client/down_file.php where improper handling of the uuid parameter allows attackers to inject malicious SQL statements. The attack can be launched remotely without authentication, potentially compromising the entire database backend and enabling unauthorized access to sensitive communication and dispatch data.

Critical Impact

Unauthenticated remote attackers can exploit this SQL injection vulnerability to extract, modify, or delete database contents, potentially compromising critical communication infrastructure and dispatch operations.

Affected Products

• Fujian Kelixin Communication Command and Dispatch Platform (versions up to 20240318)
• Kelixin Communication Command and Dispatch Project - All deployments using vulnerable api/client/down_file.php endpoint

Discovery Timeline

• 2024-03-19 - CVE-2024-2620 published to NVD
• 2025-02-27 - Last updated in NVD database

Technical Details for CVE-2024-2620

Vulnerability Analysis

This SQL injection vulnerability exists in the api/client/down_file.php file within the Fujian Kelixin Communication Command and Dispatch Platform. The vulnerability stems from insufficient input validation when processing the uuid parameter, allowing attackers to inject arbitrary SQL commands into database queries. Since the platform handles communication and dispatch operations, successful exploitation could expose sensitive operational data, user credentials, and system configurations stored in the backend database.

The vulnerability is remotely exploitable and requires no authentication or user interaction, making it particularly dangerous for internet-facing deployments. The exploit details have been publicly disclosed, increasing the risk of widespread exploitation attempts against vulnerable installations.

Root Cause

The root cause of this vulnerability is improper input sanitization in the down_file.php API endpoint. The application fails to properly validate, sanitize, or parameterize the uuid input parameter before incorporating it into SQL queries. This allows user-supplied input to be directly concatenated into SQL statements, enabling injection attacks. The lack of prepared statements or parameterized queries in the vulnerable code path creates a direct channel for database manipulation.

Attack Vector

The attack is network-based and targets the api/client/down_file.php endpoint. An attacker can craft malicious HTTP requests containing SQL injection payloads in the uuid parameter. Since no authentication is required, any remote attacker with network access to the platform can exploit this vulnerability.

The exploitation flow involves:

1. Identifying an accessible instance of the Kelixin Communication Command and Dispatch Platform
2. Sending crafted requests to the /api/client/down_file.php endpoint
3. Injecting SQL statements through the uuid parameter
4. Extracting database contents, modifying data, or escalating access

For detailed technical analysis of the exploitation technique, refer to the GitHub SQL Injection Vulnerability writeup or the VulDB entry #257197.

Detection Methods for CVE-2024-2620

Indicators of Compromise

• Unusual or malformed requests to /api/client/down_file.php containing SQL syntax characters (e.g., single quotes, UNION, SELECT, OR 1=1)
• Database error messages in application logs indicating SQL syntax errors or unexpected query behavior
• Unexpected database queries or data exfiltration patterns in database audit logs
• Abnormal response times or payload sizes from the down_file.php endpoint

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the uuid parameter
• Implement application-level logging to capture all requests to the api/client/down_file.php endpoint for forensic analysis
• Enable database query logging to identify anomalous SQL statements that deviate from expected patterns
• Configure intrusion detection systems (IDS) with signatures targeting SQL injection attack payloads

Monitoring Recommendations

• Monitor HTTP access logs for requests to /api/client/down_file.php with suspicious uuid parameter values
• Set up alerts for database authentication failures or unusual database user activity
• Implement network traffic analysis to detect data exfiltration attempts following potential exploitation
• Review application error logs regularly for SQL-related exceptions or stack traces

How to Mitigate CVE-2024-2620

Immediate Actions Required

• Restrict network access to the Kelixin Communication Command and Dispatch Platform to trusted IP addresses only
• Implement a Web Application Firewall (WAF) with SQL injection protection rules in front of vulnerable deployments
• Disable or restrict access to the /api/client/down_file.php endpoint if not operationally required
• Conduct a database audit to identify any signs of prior exploitation or unauthorized data access

Patch Information

As of the last update date, no official vendor patch has been publicly documented for this vulnerability. Organizations should contact Fujian Kelixin Communication Co., Ltd. directly to inquire about available security updates or patches. Until an official fix is available, implementing the workarounds and mitigation strategies listed below is strongly recommended.

For additional vulnerability details, consult the VulDB entry #257197.

Workarounds

• Deploy a reverse proxy or WAF to filter malicious SQL injection payloads before they reach the application
• Implement network segmentation to isolate the vulnerable platform from untrusted networks
• Apply input validation at the network perimeter using IDS/IPS rules targeting SQL injection patterns
• Consider temporarily disabling the affected API endpoint if file download functionality is not critical to operations

# Example: Block access to vulnerable endpoint using iptables (adjust as needed)
# This restricts access to the web server from untrusted networks
iptables -A INPUT -p tcp --dport 80 -s 0.0.0.0/0 -j DROP
iptables -A INPUT -p tcp --dport 80 -s <TRUSTED_IP_RANGE> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 0.0.0.0/0 -j DROP
iptables -A INPUT -p tcp --dport 443 -s <TRUSTED_IP_RANGE> -j ACCEPT