Introduction
Apple's infrastructure was breached through a SQL injection in Masa/Mura CMS, which shows the risk of pre-authentication flaws in widely deployed enterprise content management systems. Security teams have seen active exploitation campaigns against this flaw, and automated tools make detection and exploitation easy for attackers.
Masa CMS is an open-source enterprise content management system, forked from the legacy Mura CMS after Mura moved to a proprietary model. Enterprises and government agencies use both platforms for large-scale content delivery. Their JSON API and plugin architecture make them flexible, but also widen the attack surface for web-based threats.
Technical Information
CVE-2024-32640 is a critical SQL injection vulnerability in the processAsyncObject method of the Masa/Mura CMS JSON API. It occurs when user input to the contenthistid parameter is concatenated directly into SQL queries in the getObjects function. This affects the endpoint:
/_api/json/v1/default/?method=processAsyncObject
The root cause is insufficient input sanitization. The Lucee CFML engine, which powers the backend, escapes single quotes by default. An attacker can bypass this with a backslash escape sequence (%5c) before a single quote, which lets them inject arbitrary SQL into the query.
One detail matters: the vulnerable code path requires the isOnDisplay property to be true. Application logic usually overwrites this, but an attacker can force it by supplying any value for the previewID parameter. The final exploit URL looks like this:
/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c'&previewID=x
Once the SQL injection succeeds, attackers can escalate to remote code execution. This usually means extracting admin credentials or tokens via SQL injection, then using the CMS's plugin installation feature to upload a malicious ColdFusion Markup Language (CFML) file.
Proof of Concept
The Proof-of-Concept (PoC) for CVE-2024-32640 shows an automated way to detect and exploit the SQL injection in Mura/Masa CMS. This PoC, named 'Muraider,' streamlines both identification and exploitation.
Detection:
To detect the vulnerability, run the following command:
python3 CVE-2024-32640.py --url https://target.com/
Replace https://target.com/ with the URL of the target Mura/Masa CMS instance. This starts the detection phase, which scans the specified URL for the SQL injection vulnerability.
Exploitation with Ghauri:
For exploitation, the PoC integrates with Ghauri, a SQL injection exploitation tool. To use this, append the -g or --ghauri flag followed by Ghauri-specific arguments. For example, to retrieve database information, run:
python3 CVE-2024-32640.py --url https://target.com -g "--dbs --current-db"
This passes the detected vulnerability to Ghauri, which runs the specified SQL injection payloads to extract database information.
By automating both detection and exploitation, this PoC simplifies the work of finding and leveraging CVE-2024-32640 in Mura/Masa CMS.
References: [https://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMS]
Detection Methods
Detecting SQL injection vulnerabilities like CVE-2024-32640 in Mura/Masa CMS takes a mix of automated tools and manual analysis. One effective approach is to use scripts built to identify and exploit such flaws.
The CVE-2024-32640.py script, for instance, automates detection and exploitation. Given the target URL, the script can check for the vulnerability. It also integrates with tools like Ghauri for further exploitation, which supports commands such as retrieving database names or the current database.
Run any testing ethically and with proper authorization. Unauthorized testing can lead to legal consequences and harm to systems.
References: [https://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMS]
Affected Systems and Versions
- All versions of legacy Mura CMS are affected
- Masa CMS versions prior to 7.4.6, 7.3.13, and 7.2.8 are affected
- The vulnerability is in the
processAsyncObjectmethod, specifically when thecontenthistidparameter is used with the JSON API endpoint - Systems exposing the
/api/json/v1/default/endpoint without authentication are at risk
Vendor Security History
Masa CMS has a record of transparent, fast response to security issues. The vendor released patches for all supported branches (7.4.6, 7.3.13, 7.2.8) soon after disclosure. Earlier vulnerabilities in both Mura and Masa CMS were handled with similar transparency and speed.
