CVE-2024-30862
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands on Netentsec NS-ASG 6.3 appliances via the /3g/index.php endpoint. Successful exploitation could lead to unauthorized data access, modification, or deletion. Organizations using NS-ASG 6.3 are affected.
💻 Affected Systems
- Netentsec NS-ASG
📦 What is this software?
Ns Asg Firmware by Netentsec
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the database, including credential theft, data exfiltration, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to sensitive data stored in the database, potentially including user credentials, configuration data, and network information.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or minimal data exposure.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited with readily available tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check Netentsec vendor website for security updates and patches. Apply any available patches following vendor instructions.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests to /3g/index.php
Access Restriction
allRestrict network access to the NS-ASG management interface to trusted IP addresses only
🧯 If You Can't Patch
- Isolate the NS-ASG appliance from internet access and restrict internal network access
- Implement strict input validation and parameterized queries if source code modification is possible
🔍 How to Verify
Check if Vulnerable:
Test the /3g/index.php endpoint with SQL injection payloads (e.g., ' OR '1'='1) and monitor for database errors or unexpected responsesCheck Version:
Check NS-ASG web interface or CLI for version information (typically in System > About or similar menu)Verify Fix Applied:
Retest with SQL injection payloads after applying mitigations; successful attacks should be blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts via /3g/index.php
- HTTP requests with SQL keywords to vulnerable endpoint
Network Indicators:
- Unusual outbound database connections from NS-ASG
- Traffic patterns indicating data exfiltration
SIEM Query:
source="ns-asg-logs" AND (url="/3g/index.php" AND (payload CONTAINS "UNION" OR payload CONTAINS "SELECT" OR payload CONTAINS "OR '1'='1"))