CVE-2024-5589: Netentsec ASG SQL Injection Vulnerability

CVE-2024-5589 Overview

CVE-2024-5589 is a SQL injection vulnerability in the Netentsec NS-ASG Application Security Gateway version 6.3. The flaw resides in the /admin/config_MT.php endpoint when invoked with the action=delete parameter. Attackers can manipulate the Mid argument to inject arbitrary SQL statements against the backend database. The vulnerability is exploitable remotely over the network and requires low-level privileges. The exploit details have been publicly disclosed, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Authenticated remote attackers can inject SQL commands through the Mid parameter, enabling unauthorized read or modification of data within the appliance's backend database.

Affected Products

• Netentsec NS-ASG Application Security Gateway 6.3
• CPE: cpe:2.3:a:netentsec:application_security_gateway:6.3:*:*:*:*:*:*:*
• Component: netentsec:application_security_gateway

Discovery Timeline

• 2024-06-03 - CVE-2024-5589 published to the National Vulnerability Database
• 2025-02-07 - Last updated in the NVD database

Technical Details for CVE-2024-5589

Vulnerability Analysis

The vulnerability exists in the administrative interface of the NS-ASG Application Security Gateway. Specifically, the /admin/config_MT.php script handles a delete operation triggered by action=delete. The script accepts a Mid argument from the request and passes it into an SQL query without proper sanitization or parameterization.

An attacker who can reach the administrative endpoint can append SQL syntax to the Mid parameter. The injected payload is then concatenated into the underlying query and executed by the database engine. Successful exploitation allows reading sensitive data, modifying records, or invoking database functions exposed to the application's database account.

For verified proof-of-concept details, see the GitHub PoC Repository and VulDB entry #266847.

Root Cause

The root cause is improper neutralization of user-supplied input in an SQL statement [CWE-89]. The Mid request parameter is incorporated directly into the SQL query executed by config_MT.php. The code path lacks input validation, type coercion, and parameterized query bindings, which together would prevent SQL metacharacters from altering query structure.

Attack Vector

The attack vector is network-based. An authenticated attacker sends a crafted HTTP request to /admin/config_MT.php?action=delete with a malicious Mid value. Because the endpoint sits within the administrative scope, exploitation requires valid low-privileged credentials or access to a session reaching the admin interface. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed appliances.

No verified exploitation code is reproduced here. Refer to the public references for technical artifacts.

Detection Methods for CVE-2024-5589

Indicators of Compromise

• HTTP requests to /admin/config_MT.php?action=delete containing SQL metacharacters such as single quotes, UNION, SLEEP(, or comment sequences (--, #) in the Mid parameter.
• Unexpected database errors logged by the appliance when processing administrative delete operations.
• Administrative sessions originating from untrusted source IP ranges interacting with config_MT.php.

Detection Strategies

• Inspect web server and application logs for anomalous Mid values that include SQL syntax or encoded payloads.
• Deploy web application firewall rules that flag SQL injection patterns targeting the /admin/config_MT.php URI.
• Correlate authentication events with subsequent administrative requests to identify credential abuse against the admin interface.

Monitoring Recommendations

• Forward NS-ASG appliance logs to a centralized SIEM and alert on repeated 5xx errors or database exception traces from config_MT.php.
• Monitor outbound database query latency and error rates for spikes correlated with admin endpoint traffic.
• Track changes to administrative records and database tables that could indicate post-exploitation tampering.

How to Mitigate CVE-2024-5589

Immediate Actions Required

• Restrict network access to the NS-ASG administrative interface to trusted management subnets and VPN-bound administrators.
• Rotate administrative credentials and audit account activity on affected appliances.
• Review database logs for evidence of injection attempts against config_MT.php since June 2024.

Patch Information

No vendor patch has been published. According to the disclosure, the vendor was contacted prior to publication but did not respond. Track the VulDB advisory #266847 for any future vendor updates and contact Netentsec support for remediation status.

Workarounds

• Place the NS-ASG management interface behind a reverse proxy or WAF that enforces strict input validation on the Mid parameter.
• Block requests to /admin/config_MT.php?action=delete from any source other than approved administrative hosts.
• Apply least-privilege configuration to the database account used by the appliance to limit the impact of injected queries.

# Example NGINX rule to restrict access to the vulnerable admin endpoint
location ~* ^/admin/config_MT\.php {
    allow 10.10.0.0/24;   # Trusted management network
    deny  all;
    # Block obvious SQLi patterns in the Mid parameter
    if ($arg_Mid ~* "(union|select|sleep\(|--|#|')") {
        return 403;
    }
}