CVE-2024-53357: Easyvirt Co2scope SQLi Vulnerability

CVE-2024-53357 Overview

CVE-2024-53357 covers multiple SQL injection vulnerabilities in EasyVirt DCScope (versions 8.6.0 and earlier) and EasyVirt CO2Scope (versions 1.3.0 and earlier). The flaws affect twelve user, group, and role management endpoints exposed under the /api/user/ path. Authenticated attackers with low privileges can inject SQL payloads to add administrative accounts, modify or delete users, retrieve user data, manipulate groups, and tamper with role assignments. The vulnerability is tracked under [CWE-798] and was published to the National Vulnerability Database (NVD) on January 31, 2025.

Critical Impact
Authenticated attackers can leverage SQL injection in user management APIs to create administrator accounts and exfiltrate sensitive directory data.

Affected Products

EasyVirt DCScope versions <= 8.6.0
EasyVirt CO2Scope versions <= 1.3.0
All deployments exposing the /api/user/* administrative endpoints

Discovery Timeline

2025-01-31 - CVE-2024-53357 published to NVD
2025-05-24 - Last updated in NVD database

Technical Details for CVE-2024-53357

Vulnerability Analysis

The vulnerability set spans twelve distinct API endpoints handling identity management operations in DCScope and CO2Scope. Each affected endpoint constructs SQL statements using user-supplied input without proper parameterization or input sanitization. Attackers authenticated with low-privilege accounts can submit crafted parameters to manipulate the underlying database queries.

The twelve injection points include /api/user/addalias, /api/user/updatealias, /api/user/delalias, /api/user/aliases, /api/user/adduser, /api/user/updateuser, /api/user/deluser, /api/user/users, /api/user/addrole, /api/user/updaterole, /api/user/delrole, and /api/user/roles. The endpoints collectively cover create, read, update, and delete operations against user aliases, group records, and role definitions.

The attack vector is network-based and requires authentication but no user interaction. Successful exploitation grants attackers the ability to add admin accounts, modify role bindings, and disclose stored identity data. The published CWE mapping references [CWE-798], though the described behavior reflects classic SQL injection (CWE-89) patterns within authenticated REST endpoints.

Root Cause

The root cause lies in unsanitized concatenation of HTTP request parameters into SQL queries within the user management API handlers. Parameter binding is absent, allowing meta-characters such as quotes and statement terminators to alter query semantics. The shared code patterns across all twelve endpoints suggest a systemic input-handling defect rather than isolated bugs.

Attack Vector

An authenticated attacker sends crafted HTTP requests to any of the twelve /api/user/* endpoints with malicious SQL fragments in body or query parameters. The injected payload executes within the application database context, enabling privilege escalation through admin account creation via /api/user/addalias or /api/user/adduser. Data exfiltration is achievable through the read endpoints /api/user/aliases, /api/user/users, and /api/user/roles.

A public proof-of-concept is documented in the Elymaro GitHub PoC Repository, which details request structures for the affected routes.

Detection Methods for CVE-2024-53357

Indicators of Compromise

Unexpected POST or GET requests to /api/user/addalias, /api/user/adduser, or /api/user/addrole from low-privilege session tokens
HTTP request payloads containing SQL meta-characters such as ', --, UNION SELECT, or OR 1=1 targeting /api/user/* routes
New administrator accounts or role bindings in DCScope or CO2Scope that were not created through normal provisioning workflows
Database error responses returned from user management endpoints indicating malformed query execution

Detection Strategies

Inspect web server and application logs for /api/user/* requests containing SQL syntax tokens or encoded variants such as %27 and %3B
Correlate identity change events (user, group, or role creation and deletion) with the authenticated principal and source IP to flag low-privilege accounts performing privileged operations
Deploy a Web Application Firewall (WAF) signature targeting SQL injection patterns scoped to the DCScope and CO2Scope API base paths

Monitoring Recommendations

Enable verbose audit logging on all /api/user/* endpoints and forward to a centralized SIEM for retention and analysis
Alert on any non-administrator session that successfully invokes write endpoints such as addalias, adduser, or addrole
Monitor the DCScope and CO2Scope database for unexpected schema reads, role table modifications, and bulk record retrieval

How to Mitigate CVE-2024-53357

Immediate Actions Required

Upgrade EasyVirt DCScope to a version above 8.6.0 and CO2Scope to a version above 1.3.0 once vendor-patched releases are available
Restrict network access to DCScope and CO2Scope management interfaces to trusted administrative networks and VPN segments
Audit existing user, group, and role records to identify and remove unauthorized accounts created through exploitation
Rotate credentials for all low-privilege application accounts that could be used as a starting point for authenticated exploitation

Patch Information

No vendor advisory URL is listed in the NVD entry at the time of publication. Administrators should contact EasyVirt directly for a fixed release and consult the public PoC documentation for affected endpoint references.

Workarounds

Place the DCScope and CO2Scope API behind a reverse proxy with a WAF ruleset that blocks SQL injection patterns on /api/user/* paths
Disable or firewall-restrict access to user management endpoints for non-administrative source addresses
Apply the principle of least privilege to the application database account so that DROP, ALTER, and cross-table reads are not permitted at runtime

bash

# Example nginx rule to block obvious SQLi tokens on user management routes
location ~ ^/api/user/ {
    if ($args ~* "(union|select|--|;|\bor\b\s+1=1|/\*)") { return 403; }
    if ($request_body ~* "(union|select|--|;|\bor\b\s+1=1|/\*)") { return 403; }
    proxy_pass http://dcscope_backend;
}