Unauthenticated SQL Injection in Weaver E-cology

Weaver E-cology contains a critical SQL injection vulnerability (CVE-2019-25776) within its mobile plugin endpoint. An unauthenticated attacker can exploit this flaw by submitting malicious input through the 'userIdentifiers' GET parameter. The application implements filter controls that attempt to block common SQL keywords; however, these can be bypassed by wrapping keywords in parentheses. This allows attackers to perform UNION-based SQL injection to extract data from the underlying database. The vulnerability was initially identified as being exploited in the wild by the Shadowserver Foundation on July 28, 2022. Successful exploitation provides unauthorized access to sensitive data, including administrator password hashes, which could lead to a full compromise of the application and integrated systems.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Weaver E-cology instances.
2. Attacker targets the mobile plugin endpoint known to process the 'userIdentifiers' GET parameter.
3. Attacker crafts a malicious request containing SQL keywords wrapped in parentheses to bypass existing filter controls.
4. The Weaver E-cology server processes the crafted input and executes the injected SQL command.
5. Attacker executes UNION-based queries to map the database structure and identify table names.
6. Attacker extracts sensitive information, including administrator credential hashes, from the database.
7. Attacker uses extracted hashes to crack administrator credentials or perform further unauthorized database queries.

Impact

Successful exploitation allows for unauthenticated remote data exfiltration, including the compromise of administrative user credentials. This impacts any organization running exposed Weaver E-cology instances, potentially leading to total loss of confidentiality and integrity of the application data and subsequent account takeover.

Recommendation

Prioritized, concrete actions:

• Deploy the Sigma rule below to detect SQL injection attempts targeting the mobile plugin endpoint.
• Audit web server access logs for requests to the mobile plugin endpoint containing parenthesized SQL keywords.
• Ensure Weaver E-cology is updated to the latest vendor-supplied patch for CVE-2019-25776.