CVE-2024-24021
📋 TL;DR
A SQL injection vulnerability in Novel-Plus v4.3.0-RC1 and earlier allows attackers to execute arbitrary SQL commands by manipulating offset, limit, and sort parameters in the /novel/userFeedback/list endpoint. This can lead to data theft, modification, or deletion. All users running affected versions are impacted.
💻 Affected Systems
- Novel-Plus
📦 What is this software?
Novel Plus by Xxyopen
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, or remote code execution via database functions.
Likely Case
Unauthorized access to sensitive user data stored in the database, including personal information and feedback content.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests to the vulnerable endpoint with malicious parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
Check the official Novel-Plus repository for security updates. If unavailable, implement workarounds immediately.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject malicious offset, limit, and sort parameters containing SQL syntax.
Modify the list endpoint handler to validate parameters using regex patterns (e.g., allow only digits for offset/limit, safe strings for sort).
WAF Rule
allDeploy a web application firewall rule to block SQL injection patterns in the /novel/userFeedback/list endpoint.
Add WAF rule: Block requests to /novel/userFeedback/list containing SQL keywords (UNION, SELECT, INSERT, etc.) in parameters.
🧯 If You Can't Patch
- Restrict access to the /novel/userFeedback/list endpoint using network ACLs or authentication requirements.
- Monitor and log all access to the vulnerable endpoint for suspicious parameter patterns.
🔍 How to Verify
Check if Vulnerable:
Test by sending a request to /novel/userFeedback/list with parameters like offset=1' OR '1'='1 and checking for SQL errors or unexpected behavior.Check Version:
Check the Novel-Plus version in the application's configuration files or admin interface.Verify Fix Applied:
After applying fixes, retest with malicious parameters to ensure no SQL injection occurs and normal functionality remains.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /novel/userFeedback/list with parameters containing SQL keywords or special characters.
- Database error logs showing SQL syntax errors from the Novel-Plus application.
Network Indicators:
- Unusual spikes in traffic to the /novel/userFeedback/list endpoint.
- Outbound connections from the Novel-Plus server to unknown IPs indicating data exfiltration.
SIEM Query:
source="novel-plus.log" AND uri="/novel/userFeedback/list" AND (param="*UNION*" OR param="*SELECT*" OR param="*' OR '*")