CVE-2024-58352 – Unauthenticated HQL Injection Leading to Credential Theft and RCE – Landray OA (…

Summary

CVE-2024-58352 is an unauthenticated Hibernate Query Language (HQL) injection vulnerability in Landray OA (蓝凌OA), an enterprise Office Automation platform developed by Shenzhen Landray Software Co., Ltd. Rated 8.7 HIGH under CVSS 4.0 and 7.5 HIGH under CVSS 3.1, the flaw allows a remote, unauthenticated attacker to inject malicious HQL into the wechatLoginHelper.do endpoint, enabling extraction of administrator credential hashes and — under elevated database privileges — remote code execution. Active exploitation was first confirmed by the Shadowserver Foundation on March 11, 2024, well before formal CVE assignment.

Technical details

• Root cause: User-supplied input in the uid POST parameter is concatenated directly into a Hibernate findList() filter expression without any sanitization, enabling arbitrary HQL injection (CWE-564: SQL Injection — Hibernate). The injection supports error-based techniques, such as use of updatexml(), to extract data from Hibernate entity classes such as SysOrgPerson.
• Trigger conditions: A single unauthenticated HTTP POST request to /third/wechat/wechatLoginHelper.do carrying a malicious uid value is sufficient to trigger exploitation — no credentials, prior session, or user interaction of any kind are required.
• Attack vector: Network-accessible endpoint with no authentication, no user interaction, and low attack complexity.
• Impact: Attackers can query arbitrary Hibernate entity classes and extract sensitive data, including administrator login names and password hashes. If the underlying database account holds file-write privileges, attackers can write arbitrary files to the server filesystem, escalating to remote code execution (RCE). A public proof-of-concept demonstrating error-based injection against this endpoint is available on GitHub.

Affected software

• Shenzhen Landray Software Co., Ltd. — Landray OA (Office Automation): All versions (no bounded version range has been defined by the vendor or CNA)

Severity

• CVSS 4.0 Base Score: 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
• CVSS 3.1 Base Score: 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

• No vendor patch documented: No official patch has been published by Landray for this vulnerability. Organizations should monitor Landray’s official security channels for remediation updates.
• Block the vulnerable endpoint: Immediately restrict access to /third/wechat/wechatLoginHelper.do at the network perimeter, reverse proxy, or WAF layer to prevent unauthenticated POST requests from reaching the application.
• Remove internet exposure where unnecessary: If Landray OA instances do not require public internet access, isolate them from internet-facing configurations without delay.
• Audit credentials for compromise: Given confirmed in-the-wild exploitation beginning March 11, 2024, treat all Landray OA administrator accounts as potentially compromised. Rotate administrator passwords and audit for unauthorized access.
• Review access logs: Inspect web server logs for unexpected POST requests to wechatLoginHelper.do as an indicator of prior or ongoing exploitation attempts.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2024-58352 at NIST