SQL Injection in RuoYi SqlUtil.java Enables Remote Code Execution

Executive Summary

CVE-2024-57521 is an authenticated Blind SQL Injection vulnerability in the RuoYi Framework version 4.7.9 and earlier. It exists in the createTable function within SqlUtil.java, specifically in the filterKeyword method that attempts to block dangerous SQL keywords by filtering those followed by a space. However, this filtering is flawed because it only blocks keywords with a trailing space, allowing attackers to bypass it by replacing spaces with the URL-encoded vertical tab character (%0b). This bypass enables an authenticated administrator to inject arbitrary SQL commands via the 'sql' parameter, potentially extracting sensitive data such as the database version and user credentials. [2, 3]

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrative privileges can exploit this vulnerability to execute arbitrary SQL commands on the database. This can lead to full database dumping, including sensitive user credentials and system configuration data. The attacker can extract confidential information by bypassing the keyword filter and injecting crafted SQL queries, potentially compromising the confidentiality and integrity of the system. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the SQL Injection flaw in the createTable feature of RuoYi v4.7.9 and earlier. Detection involves logging in as an administrator and sending crafted SQL queries to the vulnerable endpoint `/tool/gen/createTable` using the `sql` parameter with payloads that use the `%0b` character to bypass keyword filtering. Example payloads include boolean-based SQL injection queries such as: TRUE condition: `CREATE table j2iz96_666 as SELECT%0b111 FROM sys_job WHERE 1=0 AND IF(ascii(substring((select%0b@@version),18,1))=45, 1, 1/0);` FALSE condition: `CREATE table j2iz96_665 as SELECT%0b111 FROM sys_job WHERE 1=0 AND IF(ascii(substring((select%0b@@version),5,1))=44, 1, 1/0);` These queries can be sent via HTTP POST requests to the vulnerable endpoint. A Python proof-of-concept script is also available to automate detection and exploitation. Monitoring network traffic for such suspicious requests or attempts to access `/tool/gen/createTable` with unusual `sql` parameters can help detect exploitation attempts. [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include: 1. Update the RuoYi Framework to version 4.8.0 or later, where this vulnerability is fixed. 2. If updating is not immediately possible, apply temporary fixes such as filtering out the `%0b` (vertical tab) character to prevent bypassing the keyword filter. 3. Modify the keyword filtering logic in the `filterKeyword` method to detect SQL keywords like "select" without requiring a trailing space, preventing evasion by alternative whitespace characters. 4. Restrict administrative access to the vulnerable endpoint `/tool/gen/createTable` to trusted users only. 5. Monitor and block suspicious SQL injection attempts targeting this endpoint. [2, 3]

Useful 0 Not Useful 0