CVE-2024-29875
📋 TL;DR
This is a critical SQL injection vulnerability in Sentrifugo 3.2 that allows remote attackers to execute arbitrary SQL queries through the 'sort_name' parameter. Successful exploitation could lead to complete database compromise, including extraction of sensitive user data, authentication credentials, and potentially full system control. All organizations running vulnerable Sentrifugo instances are affected.
💻 Affected Systems
- Sentrifugo
📦 What is this software?
Sentrifugo by Sapplica
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, authentication bypass, privilege escalation, and potential remote code execution through database functions.
Likely Case
Unauthorized access to sensitive HR data, user credentials, and personal information stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts would still be logged.
🎯 Exploit Status
The vulnerability is in a publicly accessible endpoint with no authentication required, making exploitation trivial for attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Sentrifugo GitHub repository for latest security patches
Vendor Advisory: https://github.com/sapplica/sentrifugo
Restart Required: Yes
Instructions:
1. Backup your current Sentrifugo installation and database
2. Download the latest patched version from the official repository
3. Replace vulnerable files with patched versions
4. Restart the web server
5. Verify the fix by testing the vulnerable endpoint
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the sort_name parameter to only allow expected values
Modify /sentrifugo/index.php/default/reports/exportactiveuserrpt to validate sort_name parameter
Web Application Firewall Rule
allBlock SQL injection patterns targeting the vulnerable endpoint
Add WAF rule: deny requests to */exportactiveuserrpt* containing SQL keywords in parameters
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Sentrifugo instance from sensitive systems
- Deploy a web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Test the endpoint /sentrifugo/index.php/default/reports/exportactiveuserrpt with SQL injection payloads in the sort_name parameterCheck Version:
Check Sentrifugo version in application configuration or about pageVerify Fix Applied:
Attempt SQL injection on the patched endpoint and verify it rejects malicious input📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to exportactiveuserrpt with suspicious parameters
- Error logs showing SQL syntax errors
Network Indicators:
- HTTP POST/GET requests to vulnerable endpoint containing SQL keywords
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/sentrifugo/index.php/default/reports/exportactiveuserrpt" AND (param="sort_name" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR")