CVE-2021-43971
📋 TL;DR
This SQL injection vulnerability in SysAid ITIL allows authenticated attackers to execute arbitrary SQL commands via the filterText parameter in the /mobile/SelectUsers.jsp endpoint. Attackers can potentially read, modify, or delete database contents, including sensitive user data. Organizations running vulnerable versions of SysAid ITIL are affected.
💻 Affected Systems
- SysAid ITIL
📦 What is this software?
Sysaid by Sysaid
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, privilege escalation to administrative access, and potential lateral movement to other systems.
Likely Case
Unauthorized access to sensitive user data, modification of system configurations, and potential extraction of credentials or other confidential information.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploitation is straightforward with authenticated access. Public proof-of-concept code is available in the referenced advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions after 20.4.74 b10
Vendor Advisory: https://www.sysaid.com/it-service-management-software/incident-management
Restart Required: Yes
Instructions:
1. Upgrade to the latest SysAid ITIL version. 2. Apply any available security patches from SysAid. 3. Restart the application server. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to sanitize the filterText parameter before processing
Implement parameterized queries or stored procedures
Add input validation regex: ^[a-zA-Z0-9_@.-]+$
Access Restriction
allRestrict access to /mobile/SelectUsers.jsp endpoint
Configure web server to block /mobile/SelectUsers.jsp
Implement IP whitelisting for the endpoint
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Restrict database user permissions to minimum required access
🔍 How to Verify
Check if Vulnerable:
Test the /mobile/SelectUsers.jsp endpoint with SQL injection payloads in the filterText parameter while authenticatedCheck Version:
Check SysAid administration panel or configuration files for version informationVerify Fix Applied:
Attempt SQL injection on the patched endpoint and verify it rejects malicious input📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by /mobile/SelectUsers.jsp access
- SQL syntax errors in application logs
Network Indicators:
- POST requests to /mobile/SelectUsers.jsp with SQL keywords in parameters
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/mobile/SelectUsers.jsp" AND (param="filterText" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "INSERT" OR value CONTAINS "DELETE")🔗 References
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md
- https://www.sysaid.com/it-service-management-software/incident-management
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md
- https://www.sysaid.com/it-service-management-software/incident-management
