SQL Injection in sar2html

The open-source monitoring tool sar2html version 4.0.0 contains a SQL injection vulnerability within the index function of the sar2html.py script. The application fails to properly sanitize the 'sort' argument provided by users, which allows an unauthenticated remote attacker to inject malicious SQL commands directly into database queries. This vulnerability is significant because a public proof-of-concept exploit is available, and the maintainers have not issued a patch to address the security flaw. Organizations currently running sar2html 4.0.0 should restrict network access to the application or implement web application firewall (WAF) rules to filter malicious payloads targeting the 'sort' parameter until a vendor-supplied update is released.

Attack Chain

1. Attacker performs reconnaissance to identify instances of sar2html 4.0.0 exposed to the internet.
2. Attacker crafts an HTTP GET or POST request targeting the index function of sar2html.py.
3. Attacker injects malicious SQL syntax into the 'sort' parameter (e.g., payloads using 'UNION SELECT' or time-based blind SQLi).
4. The web server passes the unsanitized 'sort' parameter directly to the backend database query.
5. The database executes the injected SQL command, allowing the attacker to retrieve or modify data.
6. The application returns the results of the malicious query in the HTTP response body.
7. Attacker extracts sensitive data from the database, such as administrator credentials or system configuration.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to gain unauthorized access to the underlying database. Depending on the database configuration, this can result in the exposure of sensitive application data, credential theft, or further lateral movement within the network. As there is currently no patch, all instances of sar2html 4.0.0 are considered high-risk.

Recommendation

• Implement WAF rules to block requests containing common SQL injection keywords (such as UNION, SELECT, OR, SLEEP, or --) within the 'sort' parameter of requests directed at sar2html.py.
• Audit access logs for suspicious HTTP requests containing special characters or SQL syntax in the 'sort' query parameter.
• Restrict network access to the sar2html application to trusted internal IP ranges only until the vendor provides a remediation.