CVE-2024-57619
Published: 14 January 2025
Summary
CVE-2024-57619 is a high-severity SQL Injection (CWE-89) vulnerability in Monetdb Monetdb. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 mandates validation of SQL statement inputs to prevent improper neutralization of special elements that enable SQL injection-based DoS attacks like CVE-2024-57619.
SI-2 requires timely flaw remediation, including patching the atom_get_int vulnerability in MonetDB Server to eliminate the root cause of this DoS condition.
SC-5 implements denial-of-service protections to limit the impact of resource exhaustion from crafted SQL statements exploiting CVE-2024-57619.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of public-facing DB server via crafted SQL input (SQLi) to trigger application/system DoS.
NVD Description
An issue in the atom_get_int component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Deeper analysisAI
CVE-2024-57619 is a vulnerability in the atom_get_int component of MonetDB Server version 11.47.11. The issue enables attackers to cause a Denial of Service (DoS) condition via crafted SQL statements. It is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its high availability impact.
Remote attackers can exploit this vulnerability over the network with low complexity, without requiring authentication, privileges, or user interaction. Successful exploitation results in a DoS, disrupting service availability for legitimate users while leaving confidentiality and integrity unaffected.
Mitigation details are available in the referenced GitHub issue at https://github.com/MonetDB/MonetDB/issues/7416.
Details
- CWE(s)