CVE-2024-29168: Dell Secure Connect Gateway SQL Injection

CVE-2024-29168 Overview

CVE-2024-29168 is a SQL injection vulnerability in Dell Secure Connect Gateway (SCG) versions prior to 5.22.00.00. The flaw exists in the SCG user interface for an internal assets REST API. A remote authenticated attacker can inject SQL commands into the backend database. Successful exploitation leads to unauthorized access and modification of application data. Dell tracks the issue under advisory DSA-2024-181 and classifies it under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can execute arbitrary SQL statements against the SCG backend database, compromising confidentiality, integrity, and availability of managed asset data.

Affected Products

Dell Secure Connect Gateway (SCG) Application, versions prior to 5.22.00.00
Dell Secure Connect Gateway (SCG) Appliance, versions prior to 5.22.00.00
Deployments exposing the SCG UI internal assets REST API

Discovery Timeline

2024-06-13 - CVE-2024-29168 published to the National Vulnerability Database
2024-06-13 - Dell publishes DSA-2024-181 security advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29168

Vulnerability Analysis

The vulnerability resides in the Secure Connect Gateway UI component that exposes an internal assets REST API. The API accepts input from authenticated users and passes it into SQL statements without sufficient neutralization of SQL metacharacters. This allows an attacker to break out of the intended query context and append attacker-controlled SQL.

Because SCG centrally manages telemetry and remote support connectivity for Dell hardware, the backend database contains asset inventory, credentials metadata, and configuration data. An attacker abusing this flaw can read arbitrary records, modify stored state, or corrupt integrity of managed asset records. The attack requires low privileges and no user interaction, and can be performed remotely across the network.

Root Cause

The root cause is improper neutralization of special elements in SQL commands (CWE-89). API handlers backing the SCG internal assets endpoint concatenate untrusted input into SQL queries rather than using parameterized statements or strict input validation. Any character with SQL semantic meaning, such as quotes or comment tokens, is passed to the database layer unchanged.

Attack Vector

An attacker first authenticates to the SCG UI with any valid low-privilege account. The attacker then issues a crafted HTTP request to the vulnerable internal assets REST API, embedding SQL syntax in a parameter that the backend uses inside a query. The database executes the injected clause, returning data or applying modifications outside the intended authorization scope.

The vulnerability manifests in the internal assets REST API handler within the SCG UI. Refer to the Dell DSA-2024-181 advisory for authoritative technical detail. No public proof-of-concept exploit is available at time of writing.

Detection Methods for CVE-2024-29168

Indicators of Compromise

Authenticated HTTP requests to SCG UI internal assets REST API endpoints containing SQL metacharacters such as single quotes, --, UNION SELECT, OR 1=1, or stacked query delimiters.
Backend database logs showing malformed queries, unusually long parameter values, or errors originating from asset API code paths.
Unexpected SELECT, UPDATE, or DELETE activity against SCG database tables from application service accounts.
New or modified rows in asset inventory tables that do not correlate to a legitimate administrative action.

Detection Strategies

Deploy a web application firewall rule set that inspects requests to SCG UI API paths for SQL injection payload signatures and anomalous parameter length.
Enable verbose database query logging on the SCG backend and alert on syntax errors or queries containing tautology patterns.
Correlate SCG authentication events with subsequent API activity to identify low-privilege accounts issuing high-volume asset API calls.
Baseline normal SCG API request patterns and alert on deviations in HTTP methods, parameter shapes, or response sizes.

Monitoring Recommendations

Forward SCG application, web server, and database logs to a centralized analytics platform for retention and correlation.
Alert on repeated HTTP 500 responses from SCG API endpoints, which often accompany blind SQL injection probing.
Monitor for privilege changes or credential reads inside the SCG database after suspicious API traffic.
Track outbound connections from the SCG appliance to unexpected destinations following authenticated sessions.

How to Mitigate CVE-2024-29168

Immediate Actions Required

Upgrade Dell Secure Connect Gateway to version 5.22.00.00 or later on both the application and appliance deployments.
Inventory all SCG instances, including test and disaster recovery environments, and confirm remediation status of each.
Rotate credentials for accounts that authenticated to affected SCG instances before patching, especially administrative accounts.
Review SCG database contents for unauthorized modifications to asset records and configuration tables.

Patch Information

Dell has released a fixed build in Secure Connect Gateway 5.22.00.00. Remediation guidance and download links are published in Dell advisory DSA-2024-181. The advisory addresses multiple SCG vulnerabilities, so operators should apply the cumulative update rather than a partial fix.

Workarounds

Restrict network access to the SCG UI and REST API to a dedicated management network or VPN segment.
Enforce least-privilege for SCG user accounts and remove unused or shared credentials before patching completes.
Place a web application firewall in front of SCG with SQL injection signatures enabled for the internal assets API path.
Enable multi-factor authentication on identity providers that federate into SCG to raise the cost of credentialed access.

bash

# Verify installed SCG version on the appliance
scg-cli show version

# Example WAF rule concept (ModSecurity) for SCG API paths
SecRule REQUEST_URI "@beginsWith /scg/api/assets" \
    "id:1029168,phase:2,deny,log,msg:'Possible SQLi on SCG assets API',\
     chain"
    SecRule ARGS "@rx (?i)(union(\s)+select|or\s+1=1|--|;|/\*)"