CVE-2024-7314 Scanner

AJ-Report is utilized by organizations to generate reports and manage data effectively. It serves various industries, including finance, healthcare, and education, offering robust reporting capabilities. Users leverage AJ-Report for its flexibility in handling data analytics and visual representation. The software is essential for creating insightful dashboards that help in decision-making processes. Companies choose AJ-Report because of its ease of integration with other enterprise applications. It is favored for its ability to handle large datasets and its support for multiple file formats.

Remote Code Execution (RCE) is a critical vulnerability that allows attackers to execute arbitrary code on a target machine remotely. This type of vulnerability poses severe risks as it may lead to full system compromise. Attackers exploit RCE vulnerabilities by sending crafted requests to vulnerable endpoints. In AJ-Report, before version 1.4.1, an attacker can bypass authentication and execute Java code. The vulnerability is facilitated through injection in the validation rules functionality. Successfully exploiting this vulnerability could allow full control over the compromised system.

The vulnerability lies in the /dataSetParam/verification endpoint, where the authentication can be bypassed by appending ";swagger-ui" to HTTP requests. This allows attackers to execute arbitrary Java code. The vulnerable parameter is the "validationRules", which can be exploited to run Java commands like creating processes. By leveraging the script engine injection, attackers can perform actions such as querying system information. The verification script inappropriately processes data without proper sanitization, leading to code execution. The template checks for the execution of system commands through Java's ProcessBuilder class.

Exploiting this vulnerability can lead to severe consequences, including unauthorized access, data theft, and system manipulation. Attackers could install backdoors, increasing the risk of persistent threats. It may also result in the exposure of sensitive information or disruption of services. Organizations might face reputation damage, financial loss, and potential legal challenges. Once compromised, the system might be utilized to launch attacks against other systems. Therefore, mitigating this vulnerability is crucial to safeguarding sensitive assets.

REFERENCES

• https://github.com/vulhub/vulhub/tree/master/aj-report/CNVD-2024-15077
• https://github.com/yuebusao/AJ-REPORT-EXPLOIT
• https://xz.aliyun.com/t/14460
• https://nvd.nist.gov/vuln/detail/CVE-2024-7314