CVE-2014-2323
published 2014-03-14CVE-2014-2323: SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related…
PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
61.67%
99.1th percentile
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | lighttpd | < lighttpd 1.4.33-1+nmu3 (bookworm) | lighttpd 1.4.33-1+nmu3 (bookworm) |
| lighttpd | lighttpd | < 1.4.35 | 1.4.35 |
| lighttpd | lighttpd | >= 0 < 1.4.33-1+nmu3 | 1.4.33-1+nmu3 |
| lighttpd | lighttpd | >= 0 < 1.4.33-1+nmu3 | 1.4.33-1+nmu3 |
| lighttpd | lighttpd | >= 0 < 1.4.33-1+nmu3 | 1.4.33-1+nmu3 |
| lighttpd | lighttpd | >= 0 < 1.4.33-1+nmu3 | 1.4.33-1+nmu3 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_high_availability_extension | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect SQL injection via HTTP Host header containing a UNION SELECT payload, specifically targeting lighttpd mod_mysql_vhost. Look for Host headers matching the pattern: [::1]' UNION SELECT '/ or similar IPv6-bracketed values with appended SQL syntax. ↗
- →The vulnerability is triggered via the HTTP Host header value passed to request_check_hostname in mod_mysql_vhost.c — monitor Host headers containing single quotes, UNION, or SELECT keywords on lighttpd servers. ↗
- →Regex match on HTTP response body for successful exploitation confirmation: root:[x*]:0:0: ↗
- →Use Shodan query cpe:"cpe:2.3:a:lighttpd:lighttpd" to identify potentially vulnerable internet-facing lighttpd instances for proactive detection/patching. ↗
- ·The vulnerability only affects lighttpd instances with mod_mysql_vhost enabled. Disabling this module mitigates the SQL injection vector entirely. ↗
- ·The related path traversal (CVE-2014-2324) affects mod_evhost and mod_simple_vhost when IPv6 addresses are used as host names; do not allow creation of "[...]" directories in base directories as a workaround. ↗
- ·The exploit payload uses an IPv6-bracketed Host header ([::1]) combined with SQL UNION SELECT to inject into the MySQL virtual host lookup query — detection rules should account for this specific encoding. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2014-2323: lighttpd - SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allow...
vendor_debian·2014·CVSS 9.8
CVE-2014-2323 [CRITICAL] CVE-2014-2323: lighttpd - SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allow...
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
Scope: local
bookworm: resolved (fixed in 1.4.33-1+nmu3)
bullseye: resolved (fixed in 1.4.33-1+nmu3)
forky: resolved (fixed in 1.4.33-1+nmu3)
sid: resolved (fixed in 1.4.33-1+nmu3)
trixie: resolved (fixed in 1.4.33-1+nmu3)
GHSA
GHSA-v97w-2rqc-4p78: SQL injection vulnerability in mod_mysql_vhost
ghsa_unreviewed·2022-05-13
CVE-2014-2323 [CRITICAL] CWE-89 GHSA-v97w-2rqc-4p78: SQL injection vulnerability in mod_mysql_vhost
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
OSV
CVE-2014-2323: SQL injection vulnerability in mod_mysql_vhost
osv·2014-03-14·CVSS 9.8
CVE-2014-2323 [CRITICAL] CVE-2014-2323: SQL injection vulnerability in mod_mysql_vhost
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
No detection rules found.
Nuclei
Lighttpd 1.4.34 SQL Injection and Path Traversal
nuclei·CVSS 9.8
CVE-2014-2323 [CRITICAL] Lighttpd 1.4.34 SQL Injection and Path Traversal
Lighttpd 1.4.34 SQL Injection and Path Traversal
A SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name (related to request_check_hostname).
Template:
id: CVE-2014-2323
info:
name: Lighttpd 1.4.34 SQL Injection and Path Traversal
author: geeknik
severity: critical
description: A SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name (related to request_check_hostname).
impact: |
Successful exploitation of these vulnerabilities could lead to unauthorized access to sensitive data and remote code execution
remediation: |
Upgrade to a patched version of Lighttpd or apply the necessary security patch
Bugzilla
CVE-2014-2324 CVE-2014-2323 lighttpd: SQL injection and directory traversal vulnerabilities [fedora-all]
bugzilla·2014-03-12·CVSS 9.8
CVE-2014-2324 [CRITICAL] CVE-2014-2324 CVE-2014-2323 lighttpd: SQL injection and directory traversal vulnerabilities [fedora-all]
CVE-2014-2324 CVE-2014-2323 lighttpd: SQL injection and directory traversal vulnerabilities [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Bugzilla
CVE-2014-2324 CVE-2014-2323 lighttpd: SQL injection and directory traversal vulnerabilities [epel-all]
bugzilla·2014-03-12·CVSS 9.8
CVE-2014-2324 [CRITICAL] CVE-2014-2324 CVE-2014-2323 lighttpd: SQL injection and directory traversal vulnerabilities [epel-all]
CVE-2014-2324 CVE-2014-2323 lighttpd: SQL injection and directory traversal vulnerabilities [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available
Bugzilla
CVE-2014-2323 CVE-2014-2324 lighttpd: SQL injection and directory traversal vulnerabilities
bugzilla·2014-03-12·CVSS 9.8
CVE-2014-2323 [CRITICAL] CVE-2014-2323 CVE-2014-2324 lighttpd: SQL injection and directory traversal vulnerabilities
CVE-2014-2323 CVE-2014-2324 lighttpd: SQL injection and directory traversal vulnerabilities
It was reported [1] that lighttpd's mod_mysql_vhost module is vulnerable to SQL injection attacks (CVE-2014-2323), and the mod_evhost or mod_simple_vhost modules are vulnerable to directory traversal attacks (CVE-2014-2324). More information can be found at [2].
This issue has been fixed in version 1.4.35 of lighttpd [3], and the patch is available at [4].
A workaround for this issue exists:
* Disable the mod_mysql_vhost module.
* Do not use the mod_evhost or mod_simple_vhost modules for IPv6 addresses as host names (i.e. don't have and don't allow creation of "[...]" directories in the base directories).
[1] http://seclists.org/oss-sec/2014/q1/561
[2] http://download.lighttpd.net/lighttpd/secu
arXiv
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
arxiv_fulltext·2022-12-29
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
## Abstract
Currently, the development of IoT firmware heavily depends on third-party components (TPCs) to improve development efficiency. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will influence the security of IoT firmware. Existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implement , which leverages syntactical features and control-flow graph features to detect the TPCs in firmware, and then recognizes the corresponding vulnerabilities. Based on , we present the first l
arXiv
Talos: Neutralizing Vulnerabilities with Security Workarounds for Rapid Response
arxiv_fulltext·2017-11-02
Talos: Neutralizing Vulnerabilities with Security Workarounds for Rapid Response
Talos: Neutralizing Vulnerabilities with Security Workarounds for Rapid Response
Zhen Huang0.25in
Mariana D'Angelo0.25in
Dhaval Miyani0.25in
David Lie
University of Toronto
\z.huang,mariana.dangelo,dhaval.miyani\@mail.utoronto.ca,[email protected]
## Abstract
There is often a considerable delay between the discovery of a vulnerability and the issue of a patch. One way to mitigate this window of vulnerability is to use a configuration workaround, which prevents the vulnerable code from being executed at the cost of some lost functionality -- but only if one is available. Since application configurations are not specifically designed to mitigate software vulnerabilities, we find that they only cover 25.2% of vulnerabilities.
To minimize patch delay vulnerabilities and address the lim
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txthttp://jvn.jp/en/jp/JVN37417423/index.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-04/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-04/msg00006.htmlhttp://marc.info/?l=bugtraq&m=141576815022399&w=2http://seclists.org/oss-sec/2014/q1/561http://seclists.org/oss-sec/2014/q1/564http://secunia.com/advisories/57404http://secunia.com/advisories/57514http://www.debian.org/security/2014/dsa-2877http://www.lighttpd.net/2014/3/12/1.4.35/http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txthttp://jvn.jp/en/jp/JVN37417423/index.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-04/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-04/msg00006.htmlhttp://marc.info/?l=bugtraq&m=141576815022399&w=2http://seclists.org/oss-sec/2014/q1/561http://seclists.org/oss-sec/2014/q1/564http://secunia.com/advisories/57404http://secunia.com/advisories/57514http://www.debian.org/security/2014/dsa-2877http://www.lighttpd.net/2014/3/12/1.4.35/
2014-03-14
Published