CVE-2024-57643
Published: 14 January 2025
Summary
CVE-2024-57643 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 47.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-57643 is a denial-of-service vulnerability in the box_deserialize_string component of OpenLink Virtuoso OpenSource version 7.2.11. The flaw allows attackers to trigger a DoS condition through specially crafted SQL statements, as documented with CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability received a CVSS v3.1 base score of 7.5, reflecting its high severity due to the potential for significant availability impact.
Remote attackers can exploit this vulnerability over the network with low complexity and no required privileges or user interaction. Unauthenticated adversaries need only send malicious SQL statements to the affected Virtuoso instance, resulting in a crash or resource exhaustion that disrupts service availability without impacting confidentiality or integrity.
The primary reference for this issue is a GitHub issue tracker entry at https://github.com/openlink/virtuoso-opensource/issues/1181, which likely contains additional details on reproduction, analysis, or potential patches, though specific mitigation steps are not detailed in the CVE publication. Security practitioners should monitor the Virtuoso project for updates and consider restricting SQL input validation or upgrading to patched versions if available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53675
Vulnerability details
An issue in the box_deserialize_string component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote exploitation of a public-facing DB application via crafted SQL input to trigger crash/resource exhaustion (T1499.004 Application or System Exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates SQL statement inputs to the box_deserialize_string component, preventing crafted statements from triggering the deserialization-based DoS.
Implements mechanisms to protect against DoS attacks caused by resource exhaustion or crashes from malformed SQL statements.
Ensures timely remediation of the specific flaw in Virtuoso v7.2.11's box_deserialize_string via vulnerability scanning and patching.