Unauthenticated SQL Injection and Authentication Bypass in Hongjing e-HR

Hongjing e-HR software is affected by an unauthenticated vulnerability in the getSdutyTree servlet. Attackers leverage a path traversal sequence within the request URI to bypass the oauthservlet authentication filter, allowing them to reach protected endpoints without credentials. Once authentication is bypassed, attackers can perform UNION-based SQL injection by manipulating the unsanitized codeitemid parameter. This allows for the unauthorized retrieval of sensitive information from the backend Microsoft SQL Server database, including user credentials. Exploitation in the wild was first identified by the Shadowserver Foundation on July 30, 2024. This vulnerability poses a significant risk to organizations using the e-HR platform as it facilitates full database exfiltration through unauthenticated access.

Attack Chain

1. Attacker sends a crafted HTTP GET request to the getSdutyTree servlet endpoint.
2. Request includes a path traversal sequence (e.g., ../) in the URI to bypass the oauthservlet authentication filter.
3. The application fails to validate the request path, granting access to the endpoint without an active session.
4. Attacker includes a malicious UNION-based SQL payload within the codeitemid parameter.
5. The application passes the unsanitized input directly to the backend Microsoft SQL Server database query.
6. The database executes the injected SQL command and returns the results of the UNION query within the application response.
7. Attacker parses the response to exfiltrate user credentials and other sensitive data.

Impact

Successful exploitation allows remote, unauthenticated attackers to bypass security controls and perform unauthorized data exfiltration from the e-HR database. This can lead to a complete compromise of user credentials and the exposure of sensitive organizational information, potentially facilitating further lateral movement or additional system access.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Deploy webserver logs monitoring to detect URI patterns containing path traversal sequences directed at the getSdutyTree servlet.
• Audit Microsoft SQL Server database logs for unexpected UNION SELECT or sensitive information schema queries originating from the application service account.
• Apply vendor-supplied patches for CVE-2024-58374 on all internet-facing e-HR instances immediately.
• Inspect web server access logs for anomalous GET requests containing non-alphanumeric characters or SQL keywords in the codeitemid parameter.