SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)

Successful exploitation of CVE-2024-5276 allows an attacker to inject malicious SQL code into FileCatalyst Workflow, enabling them to manipulate the application's database. This can result in the creation of unauthorized administrative users, granting attackers elevated privileges within the system. Furthermore, attackers can modify existing data within the database, potentially corrupting or deleting critical information. While direct data exfiltration via SQL injection is not possible with this specific vulnerability, the ability to modify data poses a significant risk to data integrity and system security. The requirement for anonymous access or an authenticated user to exploit the vulnerability narrows the scope somewhat, but still presents a considerable threat.

Organizations utilizing FileCatalyst Workflow, particularly those with anonymous access enabled or legacy configurations running versions 0 through 5.1.6, are at significant risk. Shared hosting environments where multiple users share the same FileCatalyst Workflow instance are also particularly vulnerable, as an attacker could potentially compromise the entire system through a single vulnerable instance.

• linux / server: Monitor FileCatalyst Workflow logs for unusual SQL queries or error messages indicative of injection attempts. Use journalctl -f to monitor relevant log files in real-time.

journalctl -f -u filecatalyst_workflow | grep "SQL injection"

• generic web: Use curl to test vulnerable endpoints with common SQL injection payloads. Examine response headers and content for signs of successful injection.

curl -X POST -d "param='; DROP TABLE users; --" https://your-filecatalyst-workflow-url/vulnerable-endpoint

• database (mysql): If you have access to the underlying MySQL database, check for unauthorized user accounts or modified data that could indicate exploitation.

SELECT user, host FROM mysql.user WHERE user NOT IN ('root');

1. 2024-06-25Disclosure

   disclosure

1. Gereserveerd2024-05-23
2. Gepubliceerd2024-06-25
3. Gewijzigd2024-08-01
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-5276 is to upgrade FileCatalyst Workflow to version 5.1.7 or later. If an immediate upgrade is not feasible, disable anonymous access to the Workflow system to prevent unauthenticated exploitation. Consider implementing Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the vulnerable endpoints. Thoroughly review and validate all user inputs to prevent malicious SQL code from being injected. After upgrading, confirm the fix by attempting a SQL injection attack on the vulnerable endpoint and verifying that it is blocked.