CVE-2024-6795: Baxter Connex Health Portal SQLi Flaw

CVE-2024-6795 Overview

CVE-2024-6795 is a critical SQL Injection vulnerability discovered in the Baxter Connex Health Portal, a healthcare management platform. The vulnerability affects all versions of the Connex Health Portal released before August 30, 2024. This flaw allows unauthenticated attackers to gain unauthorized access to the portal's database through crafted SQL injection payloads.

An attacker exploiting this vulnerability could submit specially crafted payloads to the Connex portal, resulting in modification and disclosure of database content. Additionally, the vulnerability enables administrative operations including the ability to shut down the database entirely, posing severe risks to healthcare operations and patient data confidentiality.

Critical Impact

Unauthenticated attackers can exploit SQL injection flaws to access, modify, or delete sensitive healthcare data, and perform administrative database operations including complete database shutdown.

Affected Products

• Baxter Connex Health Portal (all versions released before August 30, 2024)

Discovery Timeline

• September 9, 2024 - CVE-2024-6795 published to NVD
• September 20, 2024 - Last updated in NVD database

Technical Details for CVE-2024-6795

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) in the Baxter Connex Health Portal allows remote attackers to manipulate database queries without requiring authentication. The vulnerability exists in one or more input fields within the web portal that fail to properly sanitize user-supplied data before incorporating it into SQL queries.

The critical nature of this vulnerability stems from its accessibility—attackers require no authentication or user interaction to exploit it. This means anyone with network access to the portal can potentially craft malicious payloads to extract sensitive healthcare information, modify patient records, or disrupt database operations entirely.

Healthcare portals like Connex typically contain highly sensitive Protected Health Information (PHI), making this vulnerability particularly concerning from both a security and regulatory compliance perspective (HIPAA, GDPR, etc.).

Root Cause

The root cause is improper input validation and failure to use parameterized queries or prepared statements when constructing SQL commands. User-supplied input is directly concatenated into SQL query strings without proper sanitization or encoding, allowing attackers to inject malicious SQL code that the database executes alongside legitimate queries.

This represents a fundamental secure coding failure where input validation controls were either missing or insufficient at the application layer.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can remotely exploit this vulnerability by:

1. Identifying vulnerable input fields in the Connex Health Portal web interface
2. Crafting SQL injection payloads designed to manipulate database queries
3. Submitting these payloads through HTTP requests to the portal
4. Leveraging successful injection to extract data, modify records, or execute administrative commands

The vulnerability allows attackers to perform various database operations including reading sensitive healthcare data, modifying or deleting records, and executing administrative commands such as database shutdown. For detailed technical information, refer to the CISA Medical Advisory ICSMA-24-249-01.

Detection Methods for CVE-2024-6795

Indicators of Compromise

• Unusual SQL error messages in application logs or error responses returned to users
• Anomalous database query patterns containing SQL metacharacters (', ", ;, --, OR 1=1, UNION SELECT)
• Unexpected database administrative operations or shutdown events
• Evidence of bulk data extraction or unauthorized data access in database audit logs

Detection Strategies

• Deploy Web Application Firewalls (WAF) with SQL injection detection rules to identify and block malicious payloads
• Enable database query logging and monitor for suspicious query patterns indicative of injection attempts
• Implement intrusion detection systems (IDS) configured with signatures for common SQL injection attack patterns
• Review HTTP request logs for parameters containing SQL syntax and metacharacters

Monitoring Recommendations

• Enable comprehensive audit logging on the Connex Health Portal database to track all query execution
• Monitor for failed authentication attempts followed by successful database access, which may indicate exploitation
• Set up alerts for database administrative operations occurring outside normal maintenance windows
• Establish baseline network traffic patterns and alert on anomalous outbound data transfers from the database server

How to Mitigate CVE-2024-6795

Immediate Actions Required

• Update the Baxter Connex Health Portal to a version released on or after August 30, 2024
• Review database audit logs to identify any potential unauthorized access or data modification prior to patching
• Conduct a security assessment to determine if the vulnerability has been exploited in your environment
• Notify affected parties and regulatory bodies if evidence of data breach is discovered

Patch Information

Baxter has released a patched version of the Connex Health Portal addressing this SQL injection vulnerability. Organizations should upgrade to versions released on or after August 30, 2024. For specific patch details and upgrade instructions, consult the CISA Medical Advisory ICSMA-24-249-01 and contact Baxter support for the latest secure version.

Workarounds

• Implement a Web Application Firewall (WAF) in front of the Connex Health Portal with SQL injection detection rules enabled as a temporary protective measure
• Restrict network access to the Connex Health Portal to trusted IP ranges and VPN-only connections where possible
• Apply principle of least privilege to database accounts used by the application to limit potential damage from successful exploitation
• Consider temporarily taking the portal offline if immediate patching is not possible and the system is internet-facing

# Example WAF rule for SQL injection detection (generic)
# Consult your specific WAF documentation for implementation
# Block requests containing common SQL injection patterns
SecRule ARGS "@detectSQLi" \
    "id:1001,\
    phase:2,\
    block,\
    msg:'SQL Injection Attack Detected',\
    log,\
    severity:CRITICAL"