CVE-2024-30867
📋 TL;DR
This SQL injection vulnerability in netentsec NS-ASG 6.3 allows attackers to execute arbitrary SQL commands via the /admin/edit_virtual_site_info.php endpoint. Organizations using NS-ASG 6.3 for application security gateway functions are affected, potentially exposing sensitive data and system control.
💻 Affected Systems
- netentsec NS-ASG
📦 What is this software?
Ns Asg Firmware by Netentsec
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including administrative access, data exfiltration, and potential lateral movement to connected systems.
Likely Case
Database information disclosure, authentication bypass, and privilege escalation leading to unauthorized administrative access.
If Mitigated
Limited impact with proper input validation, WAF protection, and network segmentation in place.
🎯 Exploit Status
Exploit requires admin access but SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Contact netentsec vendor for patch availability
2. Apply any available security updates
3. Verify fix by testing the vulnerable endpoint
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for all parameters in edit_virtual_site_info.php
Modify PHP code to use prepared statements and parameterized queries
Access Restriction
allRestrict access to /admin/edit_virtual_site_info.php endpoint
Add IP whitelisting or authentication requirements in web server configuration
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Network segmentation to isolate NS-ASG from critical systems
🔍 How to Verify
Check if Vulnerable:
Test /admin/edit_virtual_site_info.php endpoint with SQL injection payloads like ' OR '1'='1Check Version:
Check NS-ASG admin interface or system information for version detailsVerify Fix Applied:
Retest vulnerable endpoint with SQL injection payloads to confirm no database interaction occurs📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by admin access
- Unexpected parameter values in web server logs
Network Indicators:
- Unusual traffic patterns to /admin/edit_virtual_site_info.php
- SQL error messages in HTTP responses
SIEM Query:
source="web_server" AND uri="/admin/edit_virtual_site_info.php" AND (param="*sql*" OR param="*union*" OR param="*select*" OR param="*or 1=1*")