CVE-2024-2644: Netentsec ASG SQL Injection Vulnerability

CVE-2024-2644 Overview

CVE-2024-2644 is a SQL injection vulnerability in Netentsec NS-ASG Application Security Gateway 6.3. The flaw resides in the /protocol/firewall/addfirewall.php endpoint, where the FireWallTableArray argument is passed to backend SQL operations without proper sanitization [CWE-89]. Remote attackers can exploit the issue across the network without authentication or user interaction. Public disclosure of the vulnerability includes proof-of-concept details, increasing exposure risk for unpatched deployments. The vendor was contacted before public disclosure but did not respond, and no official patch is referenced in the advisory.

Critical Impact
Unauthenticated remote attackers can manipulate the FireWallTableArray parameter to execute arbitrary SQL queries, leading to full compromise of confidentiality, integrity, and availability of the gateway's database.

Affected Products

Netentsec NS-ASG Application Security Gateway 6.3
CPE: cpe:2.3:a:netentsec:application_security_gateway:6.3
Component: /protocol/firewall/addfirewall.php

Discovery Timeline

2024-03-19 - CVE-2024-2644 published to NVD (VDB-257282 assigned)
2025-02-07 - Last updated in NVD database

Technical Details for CVE-2024-2644

Vulnerability Analysis

The vulnerability exists in the firewall management module of the NS-ASG appliance. The PHP script /protocol/firewall/addfirewall.php accepts the FireWallTableArray parameter and incorporates its value into SQL statements without parameterization or input validation. Attackers reach the endpoint remotely over the network and submit crafted payloads that alter query semantics. Because the affected product is a security gateway, successful exploitation undermines the perimeter device intended to enforce application-layer protections.

Exploitation requires no authentication and no user interaction. Successful injection enables data extraction, modification of firewall configuration records, authentication bypass through manipulated lookups, or destructive operations against the underlying database. The exploit has been disclosed publicly through VulDB entry 257282 and an external GitHub proof-of-concept repository.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. The addfirewall.php handler concatenates the FireWallTableArray input directly into SQL statements rather than using prepared statements or parameter binding. Server-side input filtering and type enforcement are absent for this argument.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP request to the vulnerable endpoint on the management interface of the NS-ASG appliance with a malicious FireWallTableArray value. The request requires no credentials. The injected SQL is executed within the database context of the application, providing read and write access to backend tables. Refer to the GitHub PoC Repository and VulDB #257282 for technical details.

Detection Methods for CVE-2024-2644

Indicators of Compromise

HTTP POST or GET requests to /protocol/firewall/addfirewall.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the FireWallTableArray parameter.
Unexpected modifications to firewall rule tables or new administrator records appearing in the NS-ASG database.
Web server access logs showing repeated requests to the addfirewall.php endpoint from a single external source.
Database error messages returned to clients that reference SQL syntax or table structure.

Detection Strategies

Deploy web application firewall signatures that inspect requests to /protocol/firewall/ for SQL injection patterns targeting FireWallTableArray.
Enable verbose web server logging on the NS-ASG management interface and forward logs to a centralized analytics platform for parameter inspection.
Hunt historical proxy and firewall logs for requests matching the public proof-of-concept payload published on GitHub.

Monitoring Recommendations

Alert on any external network traffic reaching the NS-ASG management interface, which should typically be restricted to administrative networks.
Monitor authentication and configuration audit logs on the appliance for changes that do not correlate with approved administrator activity.
Track outbound connections initiated by the appliance, which may indicate post-exploitation data exfiltration.

How to Mitigate CVE-2024-2644

Immediate Actions Required

Restrict network access to the NS-ASG management interface using upstream firewall rules, allowing connections only from trusted administrator subnets or VPN endpoints.
Block external access to /protocol/firewall/addfirewall.php at any reverse proxy or WAF in front of the appliance.
Review NS-ASG configuration and database records for unauthorized firewall rule changes or new administrative accounts.
Rotate credentials and session tokens used to administer the appliance if exposure is suspected.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-2644. The vendor did not respond to disclosure attempts according to the public advisory. Organizations operating Netentsec NS-ASG 6.3 should contact the vendor directly for remediation guidance and consider replacing the appliance if a fix is not available.

Workarounds

Place the NS-ASG management interface behind a VPN and disable direct internet exposure.
Deploy WAF rules that drop requests containing SQL injection patterns targeting the FireWallTableArray parameter and the addfirewall.php path.
Implement strict source IP allowlists at the network layer for any HTTP path under /protocol/firewall/.
Increase logging verbosity and forward access logs to a SIEM for continuous review until a vendor fix is available.

bash

# Example WAF/proxy rule concept (nginx) to block the vulnerable endpoint from untrusted sources
location /protocol/firewall/addfirewall.php {
    allow 10.0.0.0/8;       # trusted admin network
    deny all;
    if ($args ~* "FireWallTableArray=.*(union|select|sleep\(|--|';)") {
        return 403;
    }
}