CVE-2024-57615
Published: 14 January 2025
Summary
CVE-2024-57615 is a high-severity SQL Injection (CWE-89) vulnerability in Monetdb Monetdb. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific flaw in MonetDB's BATcalcbetween_intern component that enables DoS via crafted SQL statements by applying vendor patches.
Implements denial-of-service protections such as rate limiting and resource throttling to block exploitation of this high-impact availability vulnerability over the network.
Validates SQL inputs to detect and reject crafted statements that trigger the DoS condition in the BATcalcbetween_intern component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Crafted SQL input to public-facing DB server enables remote exploitation (T1190) that crashes the application for DoS (T1499.004).
NVD Description
An issue in the BATcalcbetween_intern component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Deeper analysisAI
CVE-2024-57615 is a vulnerability affecting the BATcalcbetween_intern component in MonetDB Server version 11.47.11. The issue enables attackers to trigger a Denial of Service (DoS) condition by sending crafted SQL statements. It is associated with CWE-89 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
The vulnerability can be exploited by unauthenticated attackers (PR:N) over the network (AV:N) with low attack complexity (AC:L) and no requirement for user interaction (UI:N). Exploitation leads to a high-impact disruption of service (A:H) on the affected MonetDB Server instance, such as crashes or unresponsiveness, without compromising confidentiality (C:N) or integrity (I:N).
Mitigation details and further information are available in the referenced GitHub issue at https://github.com/MonetDB/MonetDB/issues/7413.
Details
- CWE(s)