CVE-2024-5276: SQL Injection in FileCatalyst Workflow

Successful exploitation of CVE-2024-5276 allows an attacker to inject malicious SQL code into FileCatalyst Workflow, enabling them to manipulate the application's database. This can result in the creation of unauthorized administrative users, granting attackers elevated privileges within the system. Furthermore, attackers can modify existing data within the database, potentially corrupting or deleting critical information. While direct data exfiltration via SQL injection is not possible with this specific vulnerability, the ability to modify data poses a significant risk to data integrity and system security. The requirement for anonymous access or an authenticated user to exploit the vulnerability narrows the scope somewhat, but still presents a considerable threat.

1. Reserved2024-05-23
2. Published2024-06-25
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-5276 is to upgrade FileCatalyst Workflow to version 5.1.7 or later. If an immediate upgrade is not feasible, disable anonymous access to the Workflow system to prevent unauthenticated exploitation. Consider implementing Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the vulnerable endpoints. Thoroughly review and validate all user inputs to prevent malicious SQL code from being injected. After upgrading, confirm the fix by attempting a SQL injection attack on the vulnerable endpoint and verifying that it is blocked.