CVE-2024-35056
📋 TL;DR
NASA AIT-Core v2.5.2 contains SQL injection vulnerabilities in the query_packets and insert functions that allow attackers to execute arbitrary SQL commands. This affects systems running the vulnerable version of NASA AIT-Core software. Successful exploitation could lead to data theft, manipulation, or remote code execution.
💻 Affected Systems
- NASA AIT-Core
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including remote code execution, data exfiltration, and potential lateral movement within the network.
Likely Case
Unauthorized database access leading to data theft, manipulation, or denial of service.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
SQL injection vulnerabilities typically have low exploitation complexity when unauthenticated access is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.5.3 or later
Vendor Advisory: https://github.com/advisories/GHSA-gpgj-xrgw-8mx2
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Download and install NASA AIT-Core v2.5.3 or later from official sources. 3. Restart the AIT-Core service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for query_packets and insert function parameters
# Implement parameterized queries in application code
# Example for Python: cursor.execute('SELECT * FROM packets WHERE id = %s', (user_input,))
Database User Privilege Reduction
allLimit database user permissions to minimum required
# MySQL example: REVOKE ALL PRIVILEGES ON database.* FROM 'ait_user'@'localhost';
# GRANT SELECT, INSERT ON database.packets TO 'ait_user'@'localhost';
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Isolate vulnerable system in network segment with strict access controls
🔍 How to Verify
Check if Vulnerable:
Check if NASA AIT-Core version is 2.5.2 by examining package version or configuration filesCheck Version:
ait --version 2>/dev/null || grep -i version /path/to/ait/config/filesVerify Fix Applied:
Verify installation of v2.5.3 or later and test query_packets/insert functions with SQL injection test payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts via query_packets function
- Unexpected database schema changes
Network Indicators:
- Unusual outbound database connections
- SQL error messages in HTTP responses
- Excessive requests to query_packets endpoint
SIEM Query:
source="database_logs" AND ("sql injection" OR "union select" OR "1=1")