CVE-2024-6007
📋 TL;DR
A critical SQL injection vulnerability in Netentsec NS-ASG Application Security Gateway 6.3 allows remote attackers to execute arbitrary SQL commands via the messagecontent parameter in /protocol/iscgwtunnel/deleteiscgwrouteconf.php. This affects all organizations using the vulnerable version of this security gateway product.
💻 Affected Systems
- Netentsec NS-ASG Application Security Gateway
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the database, allowing data theft, modification, or deletion, potentially leading to full system takeover if database privileges permit.
Likely Case
Data exfiltration from the application's database, including sensitive configuration data, user credentials, or network information.
If Mitigated
Limited impact due to proper input validation, parameterized queries, or database permission restrictions.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Network Access Control
allRestrict access to /protocol/iscgwtunnel/deleteiscgwrouteconf.php to trusted IP addresses only
🧯 If You Can't Patch
- Isolate the NS-ASG device from untrusted networks using firewall rules
- Implement strict monitoring and alerting for SQL injection attempts against the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php exists and accepts the messagecontent parameter. Test with SQL injection payloads.Check Version:
Check device web interface or CLI for version information. Typically shows 'NS-ASG 6.3'Verify Fix Applied:
Verify that SQL injection attempts against the vulnerable endpoint are properly blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple requests to /protocol/iscgwtunnel/deleteiscgwrouteconf.php with SQL-like parameters
Network Indicators:
- HTTP POST requests to the vulnerable endpoint containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/protocol/iscgwtunnel/deleteiscgwrouteconf.php" AND (param="messagecontent" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "INSERT")🔗 References
- https://github.com/SecureF1sh/findings/blob/main/ns_sqli.md
- https://vuldb.com/?ctiid.268695
- https://vuldb.com/?id.268695
- https://vuldb.com/?submit.351902
- https://github.com/SecureF1sh/findings/blob/main/ns_sqli.md
- https://vuldb.com/?ctiid.268695
- https://vuldb.com/?id.268695
- https://vuldb.com/?submit.351902
