CVE-2021-21915
📋 TL;DR
An authenticated SQL injection vulnerability exists in Advantech R-SeeNet's group_list page via the company_filter parameter. This allows attackers to execute arbitrary SQL commands, potentially compromising the database. Any organization running the vulnerable version of R-SeeNet is affected.
💻 Affected Systems
- Advantech R-SeeNet
📦 What is this software?
R Seenet by Advantech
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution on the underlying server.
Likely Case
Unauthorized data access, data exfiltration, and potential lateral movement within the network.
If Mitigated
Limited impact due to network segmentation, proper authentication controls, and input validation at other layers.
🎯 Exploit Status
Exploitation requires authentication but CSRF can bypass this requirement. SQL injection is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.16 or later
Vendor Advisory: https://www.advantech.com/support
Restart Required: Yes
Instructions:
1. Download latest version from Advantech support portal. 2. Backup current installation. 3. Install update following vendor instructions. 4. Restart R-SeeNet service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or proxy filtering for SQL injection patterns
Network Segmentation
allIsolate R-SeeNet server from internet and restrict internal access
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the R-SeeNet interface
- Enable detailed logging and monitoring for SQL injection attempts and unusual database queries
🔍 How to Verify
Check if Vulnerable:
Check R-SeeNet version in web interface or installation directory. Version 2.4.15 (30.07.2021) is vulnerable.Check Version:
Check web interface login page or installation directory for version informationVerify Fix Applied:
Verify version is 2.4.16 or later. Test company_filter parameter with SQL injection payloads to confirm they're blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by successful access
- Requests containing SQL keywords like UNION, SELECT, INSERT in company_filter parameter
Network Indicators:
- HTTP POST requests to /group_list with SQL injection patterns in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/group_list" AND (param="company_filter" AND value MATCH "(?i)(union|select|insert|delete|drop|--|;)")