CVE-2024-57653
Published: 14 January 2025
Summary
CVE-2024-57653 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific flaw in the qst_vec_set_copy component of Virtuoso v7.2.11 by applying vendor patches to prevent DoS from crafted SQL statements.
Validates SQL statement inputs to block crafted malicious queries that trigger the qst_vec_set_copy DoS vulnerability.
Protects system availability and detects DoS events resulting from exploitation of the SQL injection flaw in Virtuoso.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing DB server directly enables remote exploitation (T1190) leading to application DoS via crafted input (T1499.004).
NVD Description
An issue in the qst_vec_set_copy component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Deeper analysisAI
CVE-2024-57653 affects the qst_vec_set_copy component in OpenLink Virtuoso Open-Source version 7.2.11. The vulnerability enables attackers to trigger a Denial of Service (DoS) condition by sending crafted SQL statements. It is associated with CWE-89 (SQL Injection) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
The vulnerability can be exploited by remote, unauthenticated attackers over the network with low complexity and no requirement for user interaction. Successful exploitation disrupts service availability without affecting confidentiality or integrity, leading to a DoS that renders the affected Virtuoso instance unavailable.
Mitigation details are available in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1208. The CVE was published on 2025-01-14.
Details
- CWE(s)