Listen to this Post
This vulnerability, CVE-2024-55297, is a critical SQL injection flaw within Liferay DXP’s and Portal’s dynamic data mapping (DDM) module. The issue arises due to improper neutralization of special elements used in SQL commands. Specifically, the `com.liferay.dynamic.data.mapping.util.DDMIndexer` class fails to adequately sanitize user-controlled input passed to the `DDMStructureLocalService.getStructures` method. An attacker can craft a malicious payload through the `orderByColumn` or `keywords` parameters in HTTP requests. This unsanitized input is then concatenated directly into the `ORDER BY` clause of an SQL query constructed by the `DDMStructureFinderImpl.findByKeywords` method. By injecting crafted SQL syntax, an attacker can manipulate the query’s logic to exfiltrate, modify, or delete sensitive data stored in the connected database, such as user credentials, permissions, or custom content structures, leading to a full compromise of the application’s data integrity and confidentiality.
Platform: Liferay DXP/Portal
Version: < 7.4.3.106
Vulnerability: SQL Injection
Severity: Critical
date: 2024-12-17
Prediction: Patch Expected Q1 2025
What Undercode Say:
curl -v "http://<target>/api/jsonws/ddm.ddmstructure/get-structures" --data "groupId=20143&keywords=');<SQLi>--"
nmap -p 8080 --script http-sql-injection <target>
SELECT FROM ddmstructure WHERE structureKey LIKE '%' AND (SELECT 1 FROM (SELECT SLEEP(10))a)--%'
How Exploit:
1. Unauthenticated attacker sends crafted HTTP request.
2. Malicious SQL payload in `orderByColumn` parameter.
3. Backend concatenates payload into query.
4. Database executes manipulated SQL command.
5. Attacker extracts administrative credentials.
Protection from this CVE:
1. Apply vendor patch.
2. Use prepared statements.
3. Implement input validation.
4. Deploy WAF rules.
5. Restrict database permissions.
Impact:
1. Full database compromise.
2. Authentication bypass.
3. Data exfiltration.
4. Remote code execution.
5. Complete system takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
