CVE-2024-29875: Sapplica Sentrifugo SQLi Vulnerability

CVE-2024-29875 Overview

CVE-2024-29875 is a SQL injection vulnerability affecting Sentrifugo 3.2, a popular open-source Human Resource Management System (HRMS). The vulnerability exists in the /sentrifugo/index.php/default/reports/exportactiveuserrpt endpoint through the sort_name parameter. Successful exploitation allows a remote attacker to send specially crafted SQL queries to the server and extract all data from the database without requiring any authentication or user interaction.

Critical Impact

This vulnerability enables unauthenticated remote attackers to extract sensitive HR data including employee records, personal information, salary details, and organizational data through SQL injection attacks.

Affected Products

• Sapplica Sentrifugo version 3.2

Discovery Timeline

• March 21, 2024 - CVE-2024-29875 published to NVD
• January 24, 2025 - Last updated in NVD database

Technical Details for CVE-2024-29875

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the active user report export functionality in Sentrifugo 3.2. The sort_name parameter in the exportactiveuserrpt endpoint fails to properly sanitize user-supplied input before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL commands that are executed by the database server with the application's privileges.

The vulnerability is particularly severe because it requires no authentication to exploit, can be triggered remotely over the network, and provides attackers with the ability to read, modify, or delete data across the entire database. HR management systems typically contain highly sensitive information including employee personal details, salary information, performance reviews, and organizational data.

Root Cause

The root cause of this vulnerability is improper input validation and insufficient sanitization of the sort_name parameter before it is used in database queries. The application fails to implement parameterized queries or prepared statements, instead directly concatenating user input into SQL statements. This classic SQL injection pattern allows attackers to break out of the intended query context and execute arbitrary SQL commands.

Attack Vector

The attack is executed remotely over the network by sending malicious HTTP requests to the vulnerable endpoint. An attacker can craft a URL containing SQL injection payloads in the sort_name parameter to manipulate the database query behavior. Common exploitation techniques include UNION-based attacks to extract data from other tables, Boolean-based blind injection to infer data through application responses, and time-based blind injection using database sleep functions.

The vulnerable endpoint /sentrifugo/index.php/default/reports/exportactiveuserrpt is designed for exporting user reports, making it a natural target as it already interacts with user data. Attackers can leverage this to enumerate database schemas, extract credentials, and potentially pivot to other systems.

Detection Methods for CVE-2024-29875

Indicators of Compromise

• Unusual HTTP requests to /sentrifugo/index.php/default/reports/exportactiveuserrpt containing SQL syntax characters such as single quotes, semicolons, UNION, SELECT, or comment sequences
• Database error messages in application logs indicating SQL syntax errors
• Unexpected database queries or increased database load from the web application
• Large data exports or unusual data access patterns in database audit logs

Detection Strategies

• Implement web application firewall (WAF) rules to detect SQL injection patterns in the sort_name parameter
• Monitor HTTP access logs for requests to the vulnerable endpoint containing common SQL injection signatures
• Enable database query logging and alert on queries containing suspicious keywords or unusual syntax
• Deploy intrusion detection system (IDS) rules targeting SQL injection attack patterns

Monitoring Recommendations

• Configure real-time alerting for HTTP requests to Sentrifugo report export endpoints with suspicious parameters
• Implement database activity monitoring to detect unauthorized data extraction attempts
• Review web server access logs regularly for reconnaissance and exploitation attempts
• Monitor for abnormal outbound data transfers that may indicate data exfiltration

How to Mitigate CVE-2024-29875

Immediate Actions Required

• Restrict access to the vulnerable endpoint /sentrifugo/index.php/default/reports/exportactiveuserrpt using network-level controls or web server configuration
• Deploy a web application firewall (WAF) with SQL injection protection rules in front of Sentrifugo instances
• Implement input validation at the application level to filter SQL injection payloads from the sort_name parameter
• Review database user permissions and apply the principle of least privilege to limit potential damage

Patch Information

As of the last update to this CVE, no official patch has been released by Sapplica for this vulnerability. Organizations should monitor the INCIBE Security Notice for updates and consider implementing compensating controls until a fix is available.

Workarounds

• Block access to the vulnerable report export functionality until a patch is available
• Implement strict IP-based access controls to limit who can reach the Sentrifugo application
• Use a reverse proxy with request filtering to sanitize or reject requests containing SQL injection patterns
• Consider placing the Sentrifugo application behind a VPN for internal access only

# Apache configuration to block access to vulnerable endpoint
<Location "/sentrifugo/index.php/default/reports/exportactiveuserrpt">
    Require all denied
</Location>