CVE-2024-2644: Netentsec ASG SQL Injection Vulnerability

CVE-2024-2644 Overview

A critical SQL injection vulnerability has been identified in Netentsec NS-ASG Application Security Gateway version 6.3. The vulnerability exists in the file /protocol/firewall/addfirewall.php, where improper handling of the FireWallTableArray parameter allows attackers to inject malicious SQL commands. This flaw enables unauthenticated remote attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or complete system compromise.

Critical Impact

This SQL injection vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database, potentially compromising confidentiality, integrity, and availability of the entire security gateway appliance.

Affected Products

• Netentsec NS-ASG Application Security Gateway 6.3
• Netentsec Application Security Gateway (affected versions)

Discovery Timeline

• 2024-03-19 - CVE-2024-2644 published to NVD
• 2025-02-07 - Last updated in NVD database

Technical Details for CVE-2024-2644

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The vulnerable endpoint /protocol/firewall/addfirewall.php fails to properly sanitize user-supplied input in the FireWallTableArray parameter before incorporating it into SQL queries.

The attack surface is particularly concerning because it requires no authentication and can be exploited remotely over the network. An attacker can craft malicious HTTP requests containing SQL injection payloads that are processed by the firewall configuration endpoint. Successful exploitation could allow attackers to read sensitive data from the database, modify or delete records, execute administrative operations, or potentially gain command execution on the underlying system depending on database configuration and privileges.

The vendor (Netentsec) was contacted about this disclosure but did not respond, leaving users without official guidance or patches.

Root Cause

The root cause of this vulnerability is the failure to implement proper input validation and parameterized queries in the /protocol/firewall/addfirewall.php script. The FireWallTableArray parameter is concatenated directly into SQL statements without sanitization or the use of prepared statements, allowing attackers to break out of the intended query structure and inject arbitrary SQL commands.

Attack Vector

The attack can be launched remotely over the network without requiring authentication. An attacker sends specially crafted HTTP requests to the vulnerable endpoint, embedding SQL injection payloads within the FireWallTableArray parameter. The malicious input is then processed by the backend PHP script and executed against the database.

The exploit has been publicly disclosed, increasing the risk of exploitation. Technical details are available in the GitHub SQL Injection Exploit documentation. Attackers can leverage standard SQL injection techniques including UNION-based injection, blind SQL injection, and time-based injection depending on the application's response behavior.

Detection Methods for CVE-2024-2644

Indicators of Compromise

• Unusual HTTP requests to /protocol/firewall/addfirewall.php containing SQL keywords or special characters
• Database error messages in application logs indicating malformed SQL queries
• Unexpected modifications to firewall configuration tables in the database
• Network traffic patterns showing repeated requests to the vulnerable endpoint with varying payloads

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the FireWallTableArray parameter
• Monitor HTTP access logs for requests containing common SQL injection signatures such as UNION SELECT, OR 1=1, single quotes, and comment sequences
• Deploy network intrusion detection systems (IDS) with SQL injection detection signatures targeting the vulnerable endpoint
• Utilize SentinelOne Singularity to detect anomalous process behavior and database access patterns on gateway systems

Monitoring Recommendations

• Enable detailed logging on the NS-ASG Application Security Gateway for all HTTP requests to administrative endpoints
• Configure alerting for database query errors or unusual query patterns
• Monitor for unauthorized access attempts or privilege escalation within the gateway's management interface
• Review audit logs regularly for evidence of data exfiltration or configuration tampering

How to Mitigate CVE-2024-2644

Immediate Actions Required

• Restrict network access to the NS-ASG Application Security Gateway management interface to trusted IP addresses only
• Implement a Web Application Firewall (WAF) in front of the gateway to filter SQL injection attempts
• Place the vulnerable endpoint behind additional authentication controls if possible
• Consider isolating the affected appliance from critical network segments until a patch is available

Patch Information

No official patch information is currently available from Netentsec. The vendor was contacted about this disclosure but did not respond. Users should monitor vendor communications and apply patches immediately when released. Alternative mitigation measures should be implemented until official remediation is provided.

For additional technical details, refer to VulDB Entry #257282.

Workarounds

• Deploy network-level access controls (firewall rules, ACLs) to restrict access to the management interface
• Implement a reverse proxy with SQL injection filtering capabilities in front of the vulnerable endpoint
• Consider using virtual patching solutions that can detect and block SQL injection attempts at the application layer
• Disable or restrict access to the /protocol/firewall/addfirewall.php endpoint if functionality permits

# Example: Restrict access to management interface using iptables
# Allow only trusted admin network (192.168.1.0/24) to access management port
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP