CVE-2024-35083 - J2EEFAST v2.7. SQL Injection Vulnerability in the findPage Function of SysLoginInfoMapper.xml

A significant security vulnerability, identified as CVE-2024-35083, has been discovered in the J2EEFAST web framework, v2.7.. The vulnerability exists in its implementation of the findPage function within the SysLoginInfoMapper.xml file and could lead to potential SQL injection attacks. In this post, we will delve into the details of this vulnerability, its potential impact, and the steps needed to mitigate it, along with some code snippets and links to the original references.

Vulnerability Details

The vulnerability is a SQL injection (SQLi), which is caused due to insufficient parameter sanitization in the findPage function of SysLoginInfoMapper.xml. By exploiting this vulnerability, an attacker could inject malicious SQL queries by crafting manipulated inputs, which might enable them to obtain unauthorized access to sensitive data, manipulate the database, and potentially take control of the affected web application.

The following code snippet demonstrates the vulnerable findPage function in SysLoginInfoMapper.xml

<sql id="Base_Column_List">
    id, login_name, ipaddr, login_location, browser, os, status, msg, login_time
</sql>

<select id="findPage" resultMap="BaseResultMap" parameterType="com.j2eefast.modules.sys.entity.SysLoginInfoEntity">
    SELECT
    <include refid="Base_Column_List" />
    FROM sys_login_info
    WHERE 1=1
    <if test="loginName != null and loginName.trim() != ''">
        AND login_name LIKE CONCAT('%', #{loginName}, '%')
    </if>
    <if test="ipaddr != null and ipaddr.trim() != ''">
        AND ipaddr = #{ipaddr}
    </if>
    <if test="status != null">
        AND status = #{status}
    </if>
    <if test=" beginTimes != null">
        AND  date(create_time) &gt;= date(#{beginTimes})
    </if>
    <if test=" endTimes != null">
        AND  date(create_time) &lt;= date(#{endTimes})
    </if>
    ORDER BY id
</select>

As seen in the above code snippet, the parameters are directly used in the SQL queries without proper sanitation. This lack of sanitation makes the findPage function vulnerable to SQL injection attacks.

Exploit Details

An attacker could exploit this vulnerability by sending a crafted HTTP request with malicious SQL code as input parameters, such as loginName, ipaddr, or other referenced parameters. When the server processes the request, the injected SQL code may be executed along with the original query, granting unauthorized access to the attacker.

Mitigation

To protect your web application against this SQL injection vulnerability, developers should implement proper input validation and use parameterized queries to mitigate any potential attacks. The following code snippet provides an example of how to use parameterized queries in the findPage function:

<sql id="Base_Column_List">
    id, login_name, ipaddr, login_location, browser, os, status, msg, login_time
</sql>

<select id="findPage" resultMap="BaseResultMap" parameterType="com.j2eefast.modules.sys.entity.SysLoginInfoEntity">
    SELECT
    <include refid="Base_Column_List" />
    FROM sys_login_info
    WHERE 1=1
    <if test="loginName != null and loginName.trim() != ''">
        AND login_name LIKE CONCAT('%', #{loginName,jdbcType=VARCHAR}, '%')
    </if>
    <if test="ipaddr != null and ipaddr.trim() != ''">
        AND ipaddr = #{ipaddr,jdbcType=VARCHAR}
    </if>
    <if test="status != null">
        AND status = #{status,jdbcType=INTEGER}
    </if>
    <if test="beginTimes != null">
        AND date(create_time) &gt;= date(#{beginTimes,jdbcType=TIMESTAMP})
    </if>
    <if test="endTimes != null">
        AND date(create_time) &lt;= date(#{endTimes,jdbcType=TIMESTAMP})
    </if>
    ORDER BY id
</select>

By using parameterized queries and specifying the data types for the input parameters, the application can prevent potential security breaches caused by SQL injection attacks.

Original References

This vulnerability was initially reported by the National Vulnerability Database (NVD) and can be found at the link below:
- NVD - CVE-2024-35083

Conclusion

SQL injection vulnerabilities, such as CVE-2024-35083 in J2EEFAST v2.7., are a major threat to web applications. Ensuring that developers implement robust input validation and use parameterized queries in your application can help mitigate the risks associated with these vulnerabilities.

Timeline

Published on: 05/23/2024 17:15:30 UTC
Last modified on: 11/04/2024 20:35:06 UTC