CVE-2024-57658
Published: 14 January 2025
Summary
CVE-2024-57658 is a high-severity SQL Injection (CWE-89) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CWE-89 SQL injection by validating and sanitizing crafted SQL statements before processing in the sql_tree_hash_1 component.
Requires timely remediation of the specific flaw in Virtuoso v7.2.11 to prevent DoS exploitation.
Provides denial-of-service protections to limit or detect crashes triggered by crafted SQL statements impacting availability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote exploitation of a public-facing database server via crafted SQL input (T1190) to crash the application and achieve DoS impact (T1499.004).
NVD Description
An issue in the sql_tree_hash_1 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Deeper analysisAI
CVE-2024-57658 is a vulnerability affecting the sql_tree_hash_1 component in OpenLink Virtuoso OpenSource version 7.2.11. The issue enables attackers to trigger a Denial of Service (DoS) condition through specially crafted SQL statements. It is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction, and with low attack complexity. Successful exploitation results in a DoS, disrupting service availability by crashing the affected Virtuoso instance, while confidentiality and integrity remain unaffected.
The primary reference for this vulnerability is the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1209, which provides additional details from the OpenLink project. Security practitioners should consult this advisory for any recommended mitigations or patches.
Details
- CWE(s)