CVE-2024-32737
📋 TL;DR
An unauthenticated SQL injection vulnerability in CyberPower PowerPanel Enterprise allows remote attackers to execute arbitrary SQL commands via the 'query_contract_result' function. This can lead to sensitive information disclosure from the database. All systems running PowerPanel Enterprise versions prior to 2.8.3 are affected.
💻 Affected Systems
- CyberPower PowerPanel Enterprise
📦 What is this software?
Powerpanel by Cyberpower
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of credentials, configuration data, and sensitive operational information, potentially leading to full system takeover.
Likely Case
Unauthorized access to sensitive information stored in the database, including user credentials, device configurations, and operational data.
If Mitigated
Limited impact with proper network segmentation and database access controls, though SQL injection would still be possible.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited and this one requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.3
Vendor Advisory: https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
Restart Required: Yes
Instructions:
1. Download PowerPanel Enterprise v2.8.3 from CyberPower website. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the PowerPanel service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to PowerPanel Enterprise to only trusted internal networks.
Web Application Firewall
allDeploy a WAF with SQL injection protection rules in front of PowerPanel Enterprise.
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted IP addresses only.
- Deploy a web application firewall with SQL injection detection and prevention capabilities.
🔍 How to Verify
Check if Vulnerable:
Check PowerPanel Enterprise version in the web interface or configuration files. If version is below 2.8.3, the system is vulnerable.Check Version:
Check web interface or refer to installation documentation for version verification.Verify Fix Applied:
Confirm version is 2.8.3 or higher in the web interface or configuration files.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed authentication attempts followed by SQL-like payloads in web logs
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) to PowerPanel endpoints
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND (url="*query_contract_result*" AND (payload="*SELECT*" OR payload="*UNION*" OR payload="*OR 1=1*"))🔗 References
- https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
- https://www.tenable.com/security/research/tra-2024-14
- https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
- https://www.tenable.com/security/research/tra-2024-14
