critical CVSS 9.8

CVE-2024-9194·Kernel vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Linux allows SQL Injection.This issue affects Octopus Server: from 2024.1.0 before 2024.1.13038, from 2024.2.0 before 2024.2.9482, from 2024.3.0 before 2024.3.12766.

Severity
critical
Software
Kernel
Fixed in
2024.3.12766
Published
2024-09-30

Affected versions

From: 2024.3.164

Until: 2024.3.12766

Fixed in: 2024.3.12766

How to fix this CVE

Update Octopus Server immediately to version 2024.3.12766 or later to patch a critical SQL injection vulnerability that could allow unauthenticated remote attackers to compromise your deployment pipeline and extract sensitive data. Organizations running versions 2024.1.0–2024.1.13037, 2024.2.0–2024.2.9481, or 2024.3.0–2024.3.12765 should prioritize this update as the vulnerability requires no user interaction and can be exploited over the network.

sudo dnf update octopus-server

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET requests to Octopus Server endpoints containing SQL metacharacters in query parameters (UNION, SELECT, --) or encoded payloads (e.g., %27%20OR%20, %2d%2d); monitor for HTTP 500 errors or database timeout responses that may indicate failed injection attempts

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement parameterized query filtering: block HTTP requests containing unencoded SQL operators (UNION, INTERSECT, EXCEPT, SELECT, INSERT, UPDATE, DELETE, DROP, EXEC, SCRIPT) in GET/POST parameters. Configure WAF rules to enforce strict input validation on Octopus API endpoints and deny requests with SQL syntax characters outside of whitelisted fields.

How to check if you are affected

  1. Run `octopus-server --version` or check the Octopus Server web UI (Settings > About) to confirm your installed version number
  2. Verify that user input validation is enforced on all database query parameters by reviewing Octopus Server configuration logs for any disabled security filters
  3. Search application logs for SQL syntax errors or unusual SQL fragments in request parameters: `grep -i 'sql.*syntax\|union\|select\|insert\|update\|delete' /var/log/octopus/server.log`
  4. Confirm the patch was applied by re-checking the version number and ensuring it matches 2024.3.12766 or later

FAQ

What is CVE-2024-9194?

CVE-2024-9194 is a critical SQL injection flaw in Octopus Server that allows attackers to manipulate database queries through unvalidated user input, potentially leading to unauthorized data access, modification, or deletion without authentication.

Is CVE-2024-9194 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits have been disclosed as of the advisory date.

What versions of Octopus Server are affected by CVE-2024-9194?

Versions 2024.1.0 through 2024.1.13037, 2024.2.0 through 2024.2.9481, and 2024.3.0 through 2024.3.12765 are vulnerable. All 2024.3.164+ versions up to (but not including) 2024.3.12766 are affected.

How do I check if my Octopus Server is vulnerable to CVE-2024-9194?

Log into your Octopus Server dashboard, navigate to Settings > About, and compare the version number against the affected ranges. If your version is below 2024.3.12766, you are vulnerable.

Does Defensia detect CVE-2024-9194?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Octopus Server is installed on a monitored server, CVE-2024-9194 will appear in your dashboard with remediation steps.

Related Kernel CVEs

CVE-2021-47274CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: tracing: Correct the length check which causes memory corruption We've suffered from severe kernel crashes due to memory corruption on our production environment, like, Call Trace: [1640542.554277] general protection fault: 0000 [#1] SMP PTI [1640542.554856] CPU: 17 PID: 26996 Comm: python Kdump: loaded Tainted:G [1640542.556629] RIP: 0010:kmem_cache_alloc+0x90/0x190 [1640542.559074] RSP: 0018:ffffb16faa597df8 EFLAGS: 00010286 [1640542.559587] RAX: 0000000000000000 RBX: 0000000000400200 RCX: 0000000006e931bf [1640542.560323] RDX: 0000000006e931be RSI: 0000000000400200 RDI: ffff9a45ff004300 [1640542.560996] RBP: 0000000000400200 R08: 0000000000023420 R09: 0000000000000000 [1640542.561670] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff9a20608d [1640542.562366] R13: ffff9a45ff004300 R14: ffff9a45ff004300 R15: 696c662f65636976 [1640542.563128] FS: 00007f45d7c6f740(0000) GS:ffff9a45ff840000(0000) knlGS:0000000000000000 [1640542.563937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1640542.564557] CR2: 00007f45d71311a0 CR3: 000000189d63e004 CR4: 00000000003606e0 [1640542.565279] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1640542.566069] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1640542.566742] Call Trace: [1640542.567009] anon_vma_clone+0x5d/0x170 [1640542.567417] __split_vma+0x91/0x1a0 [1640542.567777] do_munmap+0x2c6/0x320 [1640542.568128] vm_munmap+0x54/0x70 [1640542.569990] __x64_sys_munmap+0x22/0x30 [1640542.572005] do_syscall_64+0x5b/0x1b0 [1640542.573724] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [1640542.575642] RIP: 0033:0x7f45d6e61e27 James Wang has reproduced it stably on the latest 4.19 LTS. After some debugging, we finally proved that it's due to ftrace buffer out-of-bound access using a debug tool as follows: [ 86.775200] BUG: Out-of-bounds write at addr 0xffff88aefe8b7000 [ 86.780806] no_context+0xdf/0x3c0 [ 86.784327] __do_page_fault+0x252/0x470 [ 86.788367] do_page_fault+0x32/0x140 [ 86.792145] page_fault+0x1e/0x30 [ 86.795576] strncpy_from_unsafe+0x66/0xb0 [ 86.799789] fetch_memory_string+0x25/0x40 [ 86.804002] fetch_deref_string+0x51/0x60 [ 86.808134] kprobe_trace_func+0x32d/0x3a0 [ 86.812347] kprobe_dispatcher+0x45/0x50 [ 86.816385] kprobe_ftrace_handler+0x90/0xf0 [ 86.820779] ftrace_ops_assist_func+0xa1/0x140 [ 86.825340] 0xffffffffc00750bf [ 86.828603] do_sys_open+0x5/0x1f0 [ 86.832124] do_syscall_64+0x5b/0x1b0 [ 86.835900] entry_SYSCALL_64_after_hwframe+0x44/0xa9 commit b220c049d519 ("tracing: Check length before giving out the filter buffer") adds length check to protect trace data overflow introduced in 0fc1b09ff1ff, seems that this fix can't prevent overflow entirely, the length check should also take the sizeof entry->array[0] into account, since this array[0] is filled the length of trace data and occupy addtional space and risk overflow.
CVE-2021-47378CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don't destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id.
CVE-2021-47548CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of port is 6 or 7, an array overflow could occur: port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off; because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6). To fix this possible array overflow, we first check port and if it is greater than or equal to DSAF_MAX_PORT_NUM, the function returns.
CVE-2024-0132CVSS 9NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
CVE-2024-36971CVSS 7.8In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-9194. Free for 1 server.

Get started free