Researchers found several points of entry for potential attackers, one of which was Apple’s Book Travel portal, where they took advantage of a significant SQL injection vulnerability.
Experimenting with the Masa/Mura CMS revealed the attack surface, primarily the one available within Apple’s environment.
The JSON API was the main focus because it provides access to certain functions available within Apple’s environment. A JSON API should be the source of any potentially susceptible sink researchers discover.
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
Identifying the Vulnerability Sink
In a blog post in ProjectDiscovery Cloud Platform, researchers explain how they focused SQL injection sink detection.
- Parse each CFM/CFC file.
- Go through each statement, select the statement if it’s a tag and its name is cfquery .
- Strip all tags (like cfqueryparam) inside the code block of cfquery and if it still has arguments in the codeblock then the input is not parameterized and the query is susceptible to an SQL injection, given no other validation is in place.
- Print this query.
A critical condition in the dspObjects function was found by researchers. An if condition needs to be met before invoking getObjects: the Mura servlet event handler’s isOnDisplay property needs to be set to true.
At first, researchers thought that any property on the event handler could be set by just providing the property name and value as parameters. Their debugging session inside the codebase served as the foundation for this hypothesis.
The previewID property can be set to any value by supplying it as an argument, and this will cause the isOnDisplay property to be set to true.
“Since this was an error-based SQL injection, we could exploit it quite easily to achieve Remote Code Execution (RCE). Locally, we successfully performed RCE”, researchers said.
Researchers used these procedures to successfully conduct RCE:
- Reset an Admin user’s password.
- Obtain the reset token and user ID via SQL injection.
- Use the password reset endpoint with exfiltrated info.
- Utilize plugin installation to upload CFM files.
Disclosing the Findings
The researchers duly shared the findings with Apple and the corresponding Masa and Mura CMS teams.
Apple promptly addressed the stated issue by responding and implementing a fix within two hours of the initial report.
Masa is an open-source fork of Mura CMS; they released a fixed version of Masa CMS with great transparency.
The most recent security fixes, which address another critical pre-auth SQL injection and have been assigned CVE (CVE-2024-32640), are included in the 7.4.6, 7.3.13, and 7.2.8 versions.
After many attempts to contact the Mura team about these vulnerabilities via various communication methods, no response was received.
Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide