HQL Injection in Landray OA

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive data such as administrator passwords and user personal information.

If attackers gain sufficient database privileges, they can write malicious files to the server, potentially leading to remote code execution and full system compromise.

Such exploitation can result in loss of data confidentiality and integrity, and may allow attackers to control the affected system.

Useful 0 Not Useful 0

Executive Summary

CVE-2024-58352 is an unauthenticated Hibernate Query Language (HQL) injection vulnerability in Landray OA, specifically in the wechatLoginHelper.do endpoint.

Attackers can inject malicious HQL syntax into the uid POST parameter due to insufficient input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call.

This allows unauthenticated attackers to query arbitrary Hibernate entity classes, potentially extracting sensitive data such as administrator password hashes.

With sufficient database privileges, attackers could also perform file-write operations, enabling remote code execution.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for malicious POST requests to the /third/wechat/wechatLoginHelper.do endpoint, specifically those injecting suspicious HQL or SQL syntax into the uid parameter.

One detection method is to use FOFA search syntax to identify affected assets with the query: app="Landray-OA系统".

On your system or network, you can look for POST requests containing SQL injection payloads such as the use of updatexml or other SQL functions in the uid parameter.

• Example command to detect suspicious POST requests in web server logs (Linux):
• grep -i 'POST /third/wechat/wechatLoginHelper.do' /var/log/nginx/access.log | grep -i 'uid='
• Use network traffic capture tools (e.g., tcpdump or Wireshark) to filter HTTP POST requests to the vulnerable endpoint and inspect the uid parameter for suspicious payloads.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying available patches or updates to the Landray OA system to fix the input sanitization issue in the wechatLoginHelper.do endpoint.

If patches are not yet available, implement web application firewall (WAF) rules to block or sanitize requests containing suspicious HQL or SQL injection patterns targeting the uid parameter.

Restrict access to the vulnerable endpoint by network segmentation or IP whitelisting to limit exposure.

Monitor logs and network traffic for exploitation attempts and respond accordingly.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to extract sensitive data such as administrator password hashes and potentially other sensitive information from the database.

Exposure of sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which require the protection of personal and sensitive information.

Additionally, the possibility of remote code execution through file-write operations increases the risk of unauthorized access and data breaches, further impacting compliance with security standards.

Useful 0 Not Useful 0