CVE-2024-3458: Netentsec Security Gateway SQLi Flaw

CVE-2024-3458 Overview

A critical SQL injection vulnerability has been identified in Netentsec NS-ASG Application Security Gateway version 6.3. This vulnerability exists in the /admin/add_ikev2.php file, where improper handling of the TunnelId parameter allows attackers to inject malicious SQL commands. The vulnerability can be exploited remotely without authentication, potentially allowing unauthorized access to sensitive data, database manipulation, and complete system compromise.

Critical Impact

This SQL injection vulnerability enables remote unauthenticated attackers to execute arbitrary SQL commands against the underlying database, potentially leading to data exfiltration, unauthorized administrative access, and full system compromise of the security gateway appliance.

Affected Products

• Netentsec NS-ASG Application Security Gateway 6.3
• Netentsec Application Security Gateway (version 6.3)

Discovery Timeline

• 2024-04-08 - CVE-2024-3458 published to NVD
• 2025-02-06 - Last updated in NVD database

Technical Details for CVE-2024-3458

Vulnerability Analysis

This vulnerability represents a classic SQL injection flaw (CWE-89) in the administrative interface of the Netentsec NS-ASG Application Security Gateway. The vulnerable endpoint /admin/add_ikev2.php accepts the TunnelId parameter without proper input validation or parameterized queries, allowing attackers to manipulate SQL queries executed by the application.

The vulnerability is particularly severe because it exists in an administrative function related to IKEv2 tunnel configuration, suggesting that successful exploitation could affect VPN infrastructure managed by the gateway. The attack requires no authentication and can be performed remotely over the network, making it highly accessible to potential attackers.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries or prepared statements when handling the TunnelId parameter. User-supplied input is directly concatenated into SQL queries without sanitization, allowing attackers to break out of the intended query structure and inject arbitrary SQL commands.

Attack Vector

The attack can be initiated remotely against the administrative interface of the NS-ASG Application Security Gateway. An attacker can craft malicious HTTP requests to the /admin/add_ikev2.php endpoint with specially crafted TunnelId parameter values containing SQL injection payloads.

The vulnerability allows for various SQL injection techniques including:

• Union-based injection to extract data from other database tables
• Boolean-based blind injection to infer database contents
• Time-based blind injection using database sleep functions
• Stacked queries (depending on database configuration) for data modification or command execution

A proof-of-concept has been publicly disclosed, demonstrating the exploitation methodology. Technical details are available in the GitHub PoC Repository.

Detection Methods for CVE-2024-3458

Indicators of Compromise

• Unusual SQL error messages in web server logs originating from /admin/add_ikev2.php
• HTTP requests to /admin/add_ikev2.php containing SQL syntax characters such as single quotes, double dashes, UNION, SELECT, or OR 1=1 patterns in the TunnelId parameter
• Unexpected database queries or database performance anomalies
• Evidence of data exfiltration or unauthorized database access in audit logs

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns targeting the /admin/add_ikev2.php endpoint
• Monitor HTTP request logs for suspicious payloads containing SQL injection signatures in the TunnelId parameter
• Implement database activity monitoring to detect anomalous queries from the application
• Use SentinelOne Singularity to detect and block exploitation attempts through behavioral analysis

Monitoring Recommendations

• Enable detailed logging for all requests to the NS-ASG administrative interface
• Configure alerting for SQL error patterns in application and database logs
• Monitor for unusual outbound network connections from the gateway that may indicate data exfiltration
• Implement network segmentation monitoring to detect lateral movement following potential compromise

How to Mitigate CVE-2024-3458

Immediate Actions Required

• Restrict network access to the administrative interface (/admin/) to trusted IP addresses only
• Implement a Web Application Firewall (WAF) with SQL injection detection rules in front of the vulnerable endpoint
• Review database access logs for signs of exploitation
• Consider temporarily disabling the affected functionality until a patch is available

Patch Information

No official vendor patch information has been published in the available CVE data. Organizations should contact Netentsec directly for security updates and patch availability. Monitor the VulDB entry for updates on remediation guidance.

Workarounds

• Implement network-level access controls to limit access to the administrative interface to authorized IP ranges only
• Deploy a reverse proxy or WAF with strict input validation rules for the TunnelId parameter
• If possible, disable or restrict access to the /admin/add_ikev2.php endpoint until a vendor patch is available
• Implement database-level security controls to minimize the impact of successful SQL injection attacks

# Example: Restrict admin interface access using iptables
# Allow only trusted management network
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Alternative: Use nginx location block to restrict access
# location /admin/ {
#     allow 10.0.0.0/24;
#     deny all;
# }