CVE-2024-45387: Apache Traffic Control SQLI Vulnerability

CVE-2024-45387 Overview

CVE-2024-45387 is a SQL injection vulnerability in the Traffic Ops component of Apache Traffic Control versions 8.0.0 through 8.0.1. A privileged authenticated user holding the admin, federation, operations, portal, or steering role can execute arbitrary SQL against the backing database by sending a specially crafted PUT request. The flaw is tracked under CWE-89 and stems from unsanitized input being concatenated into SQL statements within Traffic Ops.

Apache has released Apache Traffic Control 8.0.2 to address the issue. Operators of affected deployments should upgrade without delay.

Critical Impact

Authenticated attackers with common operational roles can read, modify, or destroy any data managed by Traffic Ops, including CDN configuration and credentials, leading to full content delivery network compromise.

Affected Products

• Apache Traffic Control 8.0.0
• Apache Traffic Control 8.0.1
• Traffic Ops component within the above versions

Discovery Timeline

• 2024-12-23 - CVE CVE-2024-45387 published to NVD
• 2024-12-23 - Apache published advisory on the project mailing list and OpenWall OSS-Security
• 2025-02-11 - Last updated in NVD database

Technical Details for CVE-2024-45387

Vulnerability Analysis

The vulnerability resides in Traffic Ops, the API and administrative service that controls Apache Traffic Control's CDN configuration. Traffic Ops exposes PUT endpoints that accept user-supplied parameters and pass them into SQL queries without adequate parameterization or validation. An attacker authenticated with one of the privileged roles can inject arbitrary SQL clauses through the affected PUT request body or parameters.

Because Traffic Ops mediates access to the underlying PostgreSQL database, successful injection grants the attacker the same database privileges held by the Traffic Ops service account. That typically allows full read and write access to CDN configuration tables, delivery service definitions, user credentials, and operational metadata.

The issue is classified as CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Exploitation requires network access to Traffic Ops and valid credentials in a privileged role, but no user interaction.

Root Cause

The root cause is improper neutralization of user-controlled input passed to a SQL query handler in Traffic Ops. The affected code path constructs SQL through string composition rather than using parameterized statements or a vetted ORM binding, allowing attacker-supplied syntax to alter query semantics.

Attack Vector

The attack vector is network-based. An authenticated user with the admin, federation, operations, portal, or steering role sends a crafted PUT request to a vulnerable Traffic Ops endpoint. The injected SQL executes with the privileges of the Traffic Ops database role, enabling data exfiltration, modification of CDN routing, or destructive operations. The vulnerability is detailed in the Apache Mailing List Thread and the OpenWall OSS Security Post. No public proof-of-concept code is referenced in the advisory.

Detection Methods for CVE-2024-45387

Indicators of Compromise

• PUT requests to Traffic Ops API endpoints containing SQL metacharacters such as single quotes, --, ;, UNION, or SELECT in parameter values
• Authenticated sessions from admin, federation, operations, portal, or steering accounts originating from unexpected source IPs or at unusual times
• PostgreSQL logs showing syntactically unusual queries or errors originating from the Traffic Ops service account
• Unexpected modifications to delivery services, server profiles, or user records in the Traffic Ops database

Detection Strategies

• Enable verbose request logging on Traffic Ops and inspect PUT request bodies for SQL injection signatures
• Correlate Traffic Ops API access logs with PostgreSQL pg_stat_statements output to identify malformed or unauthorized queries
• Deploy a web application firewall in front of Traffic Ops with rules tuned for SQL injection patterns on authenticated API routes

Monitoring Recommendations

• Forward Traffic Ops application logs and PostgreSQL audit logs to a centralized SIEM for retention and alerting
• Alert on database errors, role escalations, or schema-altering statements executed by the Traffic Ops service account
• Monitor for privileged role logins outside maintenance windows and from unexpected geographies

How to Mitigate CVE-2024-45387

Immediate Actions Required

• Upgrade Traffic Ops to Apache Traffic Control 8.0.2 or later as the primary remediation
• Audit accounts holding the admin, federation, operations, portal, or steering roles and remove unnecessary assignments
• Rotate credentials for any Traffic Ops user that may have been exposed, including the Traffic Ops database role
• Review Traffic Ops and PostgreSQL logs since deployment of an affected version for evidence of exploitation

Patch Information

Apache has released Apache Traffic Control 8.0.2, which addresses CVE-2024-45387. Operators running 8.0.0 or 8.0.1 should plan an immediate upgrade. Patch details and announcements are available in the Apache Mailing List Thread and the OpenWall OSS Security Post.

Workarounds

• Restrict network access to the Traffic Ops API to trusted management networks using firewall or reverse proxy rules
• Reduce the number of users assigned privileged roles until the upgrade is complete
• Apply a web application firewall ruleset that blocks SQL injection patterns on PUT requests to Traffic Ops endpoints

# Example: restrict Traffic Ops API access at the reverse proxy until 8.0.2 is deployed
location /api/ {
    allow 10.0.0.0/24;   # management subnet
    deny  all;
    proxy_pass https://traffic_ops_backend;
}