CVE-2024-57621
Published: 14 January 2025
Summary
CVE-2024-57621 is a high-severity SQL Injection (CWE-89) vulnerability in Monetdb Monetdb. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CWE-89 SQL injection by validating crafted SQL statements in the GDKanalytical_correlation component before processing.
Remediates the specific flaw in MonetDB Server v11.47.11 through timely patching as identified in the vendor advisory.
Limits the effects of DoS attacks caused by malicious SQL statements crashing the server and disrupting availability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing DB server via crafted SQL input to trigger application crash/DoS.
NVD Description
An issue in the GDKanalytical_correlation component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Deeper analysisAI
CVE-2024-57621 is a vulnerability in the GDKanalytical_correlation component of MonetDB Server version 11.47.11. The issue enables attackers to trigger a Denial of Service (DoS) condition through specially crafted SQL statements. It is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
The vulnerability can be exploited by any unauthenticated remote attacker with network access to the MonetDB Server. Exploitation requires low complexity and no user interaction, allowing attackers to send malicious SQL statements that crash the server and disrupt service availability. No privileges are needed, and there is no impact on confidentiality or integrity.
Mitigation details and further information are available in the referenced advisory at https://github.com/MonetDB/MonetDB/issues/7414.
Details
- CWE(s)