CVE-2024-29432
📋 TL;DR
Alldata v0.4.6 contains a SQL injection vulnerability in the tablename parameter at the /data/masterdata/datas endpoint. This allows attackers to execute arbitrary SQL commands on the database. Anyone running Alldata v0.4.6 is affected.
💻 Affected Systems
- Alldata
📦 What is this software?
Alldata by Alldata
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution on the database server.
Likely Case
Unauthorized data access, data modification, and potential privilege escalation within the database.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
The vulnerability is in a web endpoint and requires no authentication. Public proof-of-concept exists in the provided references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the tablename parameter to only allow alphanumeric characters and underscores.
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
🧯 If You Can't Patch
- Restrict network access to the Alldata instance using firewall rules to only allow trusted IP addresses.
- Implement database user with minimal privileges for the application to limit potential damage from SQL injection.
🔍 How to Verify
Check if Vulnerable:
Test the /data/masterdata/datas endpoint with SQL injection payloads in the tablename parameter (e.g., tablename=test' OR '1'='1).Check Version:
Check the Alldata version in the application interface or configuration files.Verify Fix Applied:
Verify that SQL injection payloads no longer execute and return appropriate error messages or are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts or unusual query patterns
Network Indicators:
- HTTP requests to /data/masterdata/datas with SQL keywords in parameters
- Unusual database query patterns from the application server
SIEM Query:
source="web_logs" AND uri="/data/masterdata/datas" AND (param="tablename" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|exec|--|#|;)")