SqlSpark: SQL Injection in TripSpark VEO Transport: CVE-2021-3262

In the ever-evolving realm of cybersecurity, My external penetration test for a client using the TripSpark VEO Transportation solution brought to light an intriguing vulnerability. This discovery has been officially registered as CVE-2021-3262, and we’d like to delve into the intricate details with you.

1. Software Overview:

The VEO Transportation software, developed by TripSpark, seeks to address the multifaceted challenges endemic to contemporary school transportation systems. Specifically crafted to cater to the unique demands of both regular and special education transportation, it boasts a nimble thin-client solution and calendar-based routing, ensuring adaptability to a wide spectrum of needs.

More insights on the software can be found here: TripSpark VEO Transportation Overview

2. Technical Details & Environment:

• Affected Version: NovusEDU-2.2.x-XP_BB-20201123-184084/ VEO—20201123-184084OS
• Test Environment: Windows Server 2012 R2 Standard, SQL Server 2012 (SP3) -11.0.6020.0 (X64)
• Type of Vulnerability: SQL Injection
• CVSSv2 Score: 9.0 (AV:N/AC:L/Au:N/C:C/I:P/A:P)

During my thorough assessment, he pinpointed a potential risk: the software did not sufficiently handle user data inputs in POST body parameters. I managed to successfully inject tailored SQL commands into the “Student Busing Information” search queries. Remarkably, this vulnerability surfaced with a complex blind SQL query.

On a deeper dive, it became evident that the “editOEN” parameter was notably vulnerable to SQL injection.

3. Potential Impacts:

The ramifications of such a flaw depend greatly on the SQL server’s configuration. At its most basic, a malicious actor could utilize this SQL injection vulnerability to assume the identity of the user running the database. This could lead to the interception of the password hash associated with the account. Once in possession, the hash could be deciphered offline or deployed in a more advanced NTLM relay attack. If the user holding the reins of the database enjoys sysadmin privileges, the risks could extend to a full compromise of the system in question. In this specific case, I was able to leverage this vulnerability to gain a foothold on the clients network and then compromise their entire Active Directory Domain and Forrest.

Figure 1: Vulnerable Webpage

Figure 2: Exploiting SQL Injection to Force Authentication

Figure 3: Capturing Forced Authentication

Figure 4: Exploit PoC

4. Potential Exploitation Tactics:

It’s interesting to note, as I highlighted, that sophisticated exploits aren’t essential to leverage this vulnerability. A variety of mainstream hacking tools, spanning Metasploit to Impacket, are well-equipped to detect and potentially exploit this vulnerability.

5. Remediation:

To shield against such threats, I recommend a two-pronged approach: Transitioning to prepared statements for SQL queries can effectively combat typical injection issues. Additionally, introducing server-side logic to cleanse user inputs prior to SQL execution offers an added layer of security.

In wrapping up, my discerning eye during this external penetration test has shed light on the imperative need for continuous software evaluation, even in robust systems like TripSpark’s VEO Transportation. I hope such disclosures pave the way for a more secure digital landscape.