CVE-2024-57656
Published: 14 January 2025
Summary
CVE-2024-57656 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 35.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates crafted SQL statement inputs to prevent SQL injection exploitation leading to server crashes in the sqlc_add_distinct_node component.
Remediates the specific flaw in OpenLink Virtuoso v7.2.11 by identifying, reporting, and applying patches in a timely manner.
Protects against denial-of-service attacks by limiting the effects of remotely exploitable crafted SQL statements that crash the server.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes remote exploitation of a SQL-handling flaw in a network-accessible database server (Virtuoso) that directly results in application/system crash and denial of service, matching T1499.004 Application or System Exploitation.
NVD Description
An issue in the sqlc_add_distinct_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Deeper analysisAI
CVE-2024-57656 is a denial-of-service (DoS) vulnerability in the sqlc_add_distinct_node component of OpenLink Virtuoso Open-Source version 7.2.11. The flaw allows attackers to crash the server through crafted SQL statements and is associated with CWE-89 (SQL Injection). It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its impact on availability.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation results in a DoS condition, disrupting service availability without affecting confidentiality or integrity.
The issue is documented in the GitHub repository for openlink/virtuoso-opensource at https://github.com/openlink/virtuoso-opensource/issues/1210. No specific patch or mitigation details are provided in the CVE record.
Details
- CWE(s)