CVE-2024-5773
📋 TL;DR
This critical SQL injection vulnerability in Netentsec NS-ASG Application Security Gateway allows remote attackers to execute arbitrary SQL commands via the messagecontent parameter in the deletemacbind.php file. Organizations using NS-ASG 6.3 are affected, potentially exposing sensitive data or gaining unauthorized access to the gateway system.
💻 Affected Systems
- Netentsec NS-ASG Application Security Gateway
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the gateway, data exfiltration, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Database information disclosure, authentication bypass, or limited system access depending on SQL injection results.
If Mitigated
No impact if proper input validation, WAF rules, and network segmentation prevent exploitation.
🎯 Exploit Status
Exploit code is publicly available, making attacks straightforward for threat actors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Contact Netentsec support for guidance.
🔧 Temporary Workarounds
Block Access to Vulnerable Endpoint
linuxRestrict access to /protocol/firewall/deletemacbind.php via firewall or WAF rules.
iptables -A INPUT -p tcp --dport 80 -m string --string "/protocol/firewall/deletemacbind.php" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/protocol/firewall/deletemacbind.php" --algo bm -j DROP
Implement WAF SQL Injection Rules
allDeploy web application firewall rules to detect and block SQL injection attempts.
🧯 If You Can't Patch
- Isolate the NS-ASG device in a dedicated network segment with strict access controls.
- Implement network monitoring and IDS/IPS rules specifically for SQL injection patterns targeting this endpoint.
🔍 How to Verify
Check if Vulnerable:
Check if NS-ASG version is 6.3 and if deletemacbind.php endpoint is accessible.Check Version:
Check device web interface or CLI for version information (specific command varies by device).Verify Fix Applied:
Test if SQL injection payloads no longer execute; verify endpoint blocking or WAF rules are effective.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to deletemacbind.php with SQL-like parameters
Network Indicators:
- HTTP POST requests to /protocol/firewall/deletemacbind.php containing SQL keywords (UNION, SELECT, etc.)
SIEM Query:
source="*ns-asg*" AND (url="/protocol/firewall/deletemacbind.php" OR messagecontent="*' OR *")