CVE-2024-6456: AVEVA Historian Server SQLi Vulnerability

CVE-2024-6456 Overview

CVE-2024-6456 is a SQL injection vulnerability in the AVEVA Historian Server REST Interface. An attacker can craft a malicious URL that, when opened by an authenticated interactive Historian REST Interface user, executes arbitrary SQL commands under that user's privileges. Exploitation requires social engineering to convince a victim to click the crafted URL. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). AVEVA Historian is widely deployed in industrial control system (ICS) environments for time-series process data storage.

Critical Impact
Successful exploitation enables execution of malicious SQL statements against the Historian database, exposing or modifying industrial process data tied to operational technology environments.

Affected Products

AVEVA Historian Server (Historian REST Interface component)
Refer to CISA ICS Advisory ICSA-24-228-10 for the full list of affected versions
Industrial Control System deployments using AVEVA Historian REST Interface

Discovery Timeline

2024-08-15 - CVE-2024-6456 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6456

Vulnerability Analysis

The vulnerability resides in the AVEVA Historian REST Interface, which accepts user-supplied input that is incorporated into SQL queries without adequate neutralization. An attacker constructs a URL containing SQL syntax embedded within request parameters. When a privileged user opens the URL in a session authenticated to the Historian REST Interface, the server processes the injected SQL under that user's database privileges. The attack vector is network-based and requires active user interaction, which aligns with the social engineering precondition described in the advisory.

Root Cause

The root cause is improper input validation and lack of parameterized queries in the REST Interface request-handling path. User-controlled URL parameters reach SQL execution without sanitization, satisfying the conditions for [CWE-89]. Because the SQL executes in the context of the interactive user, the achievable impact scales with that user's database role.

Attack Vector

The attacker delivers a specially crafted URL via phishing, chat, or web content. The victim, already authenticated to the Historian REST Interface, follows the link. The browser issues an authenticated request that carries the malicious payload, and the server executes the embedded SQL. No attacker-side credentials are required, but interactive user authentication on the victim side is needed for execution to succeed.

No verified public proof-of-concept code is available. Refer to the CISA ICS Advisory ICSA-24-228-10 for vendor-provided technical context.

Detection Methods for CVE-2024-6456

Indicators of Compromise

Inbound HTTP/HTTPS requests to the Historian REST Interface containing SQL metacharacters such as ', --, ;, UNION, or SELECT in query parameters
Referer headers pointing to external untrusted domains immediately preceding suspicious REST Interface requests
Historian database audit log entries showing unexpected DDL or DML statements executed by interactive REST users
Authentication sessions issuing atypical query volumes or accessing tables outside normal operational scope

Detection Strategies

Inspect web server and reverse proxy logs for Historian REST Interface URLs containing encoded SQL fragments
Enable SQL Server audit on the Historian backend to capture statements originating from REST Interface service accounts
Correlate browser-initiated requests (with Referer headers from email or chat clients) against REST endpoints accepting query parameters
Apply [CWE-89] detection rules and OWASP CRS SQL injection signatures at the application gateway

Monitoring Recommendations

Forward Historian REST Interface access logs and database audit logs to a centralized SIEM for correlation
Alert on first-seen SQL keywords or comment markers within REST query strings
Track interactive Historian user sessions for anomalous query patterns deviating from operational baselines
Review egress traffic from Historian servers for unexpected outbound connections that may indicate data exfiltration following SQL execution

How to Mitigate CVE-2024-6456

Immediate Actions Required

Apply the AVEVA security update referenced in CISA ICS Advisory ICSA-24-228-10 to all affected Historian Server installations
Restrict access to the Historian REST Interface to trusted management networks and authenticated operators only
Educate interactive Historian users to avoid opening unsolicited links that target internal management URLs
Review database privileges assigned to interactive REST Interface users and enforce least privilege

Patch Information

AVEVA has published remediation guidance through CISA. Administrators should consult the CISA ICS Advisory ICSA-24-228-10 for affected version ranges, fixed builds, and vendor download links. Validate patches in a staging environment before promoting to production ICS systems.

Workarounds

Place the Historian REST Interface behind a web application firewall configured with SQL injection signatures
Disable the REST Interface on Historian deployments that do not require it
Enforce network segmentation between operator workstations, business email systems, and ICS management endpoints to break the social engineering delivery path
Require operators to use dedicated, hardened workstations for Historian administration with no general-purpose browsing or email

bash

# Example: restrict Historian REST Interface to a management subnet using Windows Firewall
netsh advfirewall firewall add rule name="Historian REST Restrict" \
  dir=in action=allow protocol=TCP localport=32568 \
  remoteip=10.10.20.0/24
netsh advfirewall firewall add rule name="Historian REST Block Other" \
  dir=in action=block protocol=TCP localport=32568