CVE-2024-32888: Amazon Redshift JDBC Driver SQLi Flaw

CVE-2024-32888 Overview

CVE-2024-32888 is a SQL Injection vulnerability affecting the Amazon JDBC Driver for Redshift, a Type 4 JDBC driver that provides database connectivity through standard JDBC APIs available in Java Platform, Enterprise Editions. The vulnerability exists when using the non-default connection property preferQueryMode=simple in combination with application code that contains a vulnerable SQL statement negating a parameter value.

This SQL injection flaw is inherited from the PostgreSQL JDBC driver codebase. Importantly, when using the default extended query mode, the driver is not vulnerable. The preferQueryMode parameter is not officially supported in the Redshift JDBC driver, meaning users who have not explicitly overridden the default settings are not affected by this vulnerability.

Critical Impact

This SQL injection vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the database with potential for complete data compromise, modification, and system takeover when the non-default preferQueryMode=simple setting is enabled.

Affected Products

• Amazon JDBC Driver for Redshift versions prior to 2.1.0.28
• Applications using preferQueryMode=simple connection property
• Systems with vulnerable SQL patterns that negate parameter values

Discovery Timeline

• 2024-05-15 - CVE CVE-2024-32888 published to NVD
• 2025-06-12 - Last updated in NVD database

Technical Details for CVE-2024-32888

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) occurs due to improper neutralization of special elements used in SQL commands. The root issue manifests specifically when developers configure the JDBC connection with the unsupported preferQueryMode=simple parameter and their application code includes SQL queries that negate parameter values.

In simple query mode, the driver processes parameters differently than in the default extended query mode. When a parameter value is negated (e.g., using a minus sign or NOT operator in the SQL), the simple query mode fails to properly escape or parameterize the input, creating an injection point that attackers can exploit.

The vulnerability enables network-based attacks requiring no authentication or user interaction. Successful exploitation can result in unauthorized access to sensitive data, data manipulation, and potentially complete database compromise with effects extending beyond the vulnerable component itself.

Root Cause

The vulnerability stems from inherited code from the PostgreSQL JDBC driver (pgjdbc) that handles parameter type casting and value processing in simple query mode. The SimpleParameterList.java class contained flawed logic for determining parameter types, using a series of conditional statements that failed to properly sanitize parameter values when they were negated in SQL queries.

The problematic code path allowed specially crafted input to bypass parameter escaping, enabling SQL injection attacks when the simple query mode was explicitly enabled by application developers.

Attack Vector

The attack vector is network-based and can be exploited remotely without authentication. An attacker would need to:

1. Identify an application using the Amazon Redshift JDBC Driver with preferQueryMode=simple configured
2. Locate an endpoint where user input flows into a SQL query that negates a parameter value
3. Craft malicious SQL injection payloads that exploit the improper parameter handling

The following code shows the security patch applied to SimpleParameterList.java:

       textValue = paramValues[index].toString();
       int paramType = paramTypes[index];
 
-      if (paramType == Oid.TIMESTAMP) {
-        type = "timestamp";
-      } else if (paramType == Oid.TIMESTAMPTZ) {
-        type = "timestamp with time zone";
-      } else if (paramType == Oid.TIME) {
-        type = "time";
-      } else if (paramType == Oid.TIMETZ) {
-        type = "time with time zone";
-      } else if (paramType == Oid.DATE) {
-        type = "date";
-      } else if (paramType == Oid.INTERVAL) {
-        type = "interval";
-      } else if (paramType == Oid.INTERVALY2M) {
-        type = "interval year to month";
-      } else if (paramType == Oid.INTERVALD2S) {
-        type = "interval day to second";
-      } else if (paramType == Oid.NUMERIC) {
-        type = "numeric";
-      }
-      else {
-        type = null;
+      switch (paramTypes[index])
+      {
+        case Oid.INT2:
+          type = "int2";
+          break;
+        case Oid.INT4:

Source: GitHub Commit

Detection Methods for CVE-2024-32888

Indicators of Compromise

• Unusual or malformed SQL queries in database logs containing SQL injection patterns
• Application connection strings containing preferQueryMode=simple configuration
• Unexpected database operations or data access patterns from JDBC-connected applications
• Error messages in application logs indicating SQL syntax errors from malformed injection attempts

Detection Strategies

• Audit application configuration files and connection strings for the presence of preferQueryMode=simple parameter
• Review database audit logs for anomalous query patterns, especially those containing SQL injection signatures like ' OR 1=1, UNION SELECT, or comment sequences (--)
• Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts in HTTP parameters
• Deploy runtime application self-protection (RASP) solutions to monitor JDBC driver behavior

Monitoring Recommendations

• Enable comprehensive database query logging to capture all SQL statements executed against Redshift
• Implement real-time alerting for SQL syntax errors that may indicate injection attempts
• Monitor for unauthorized data access patterns or unexpected bulk data operations
• Track changes to JDBC connection configurations across deployed applications

How to Mitigate CVE-2024-32888

Immediate Actions Required

• Upgrade the Amazon JDBC Driver for Redshift to version 2.1.0.28 or later immediately
• Audit all application connection strings and remove any preferQueryMode=simple configurations
• Review application code for SQL patterns that negate parameter values and implement proper parameterized queries
• Conduct a security assessment of database access logs to identify potential past exploitation

Patch Information

Amazon has released a security patch in driver version 2.1.0.28 that addresses this SQL injection vulnerability. The fix modifies how parameter types are processed in SimpleParameterList.java, replacing the vulnerable conditional logic with a more secure switch-case implementation that properly handles parameter type assignment.

For detailed patch information, refer to the GitHub Security Advisory and the related commits. Additional technical context about this class of SQL injection vulnerability is available in the SonarSource blog post.

Workarounds

• Do not use the preferQueryMode=simple connection property; use the default extended query mode instead
• Implement application-level input validation and parameterized queries as defense-in-depth
• Deploy database-level monitoring and anomaly detection to identify potential exploitation attempts
• Consider implementing network segmentation to limit database access to authorized application servers only

# Configuration example - Remove preferQueryMode=simple from JDBC connection strings
# Vulnerable configuration (DO NOT USE):
# jdbc:redshift://cluster.region.redshift.amazonaws.com:5439/database?preferQueryMode=simple

# Secure configuration (DEFAULT - use this):
jdbc:redshift://cluster.region.redshift.amazonaws.com:5439/database