CVE-2024-58374 Hongjing Century CVE debrief

Who should care

Defenders responsible for the Hongjing e-HR system, security teams, and IT administrators should be aware of this vulnerability and take necessary actions to prevent exploitation. This includes verifying the presence of the system in their environment, assessing exposure, applying patches or mitigations, and monitoring for suspicious activity. Additionally, operators and platform administrators should prioritize verifying the presence of this vulnerability

Why it matters

CVE-2024-58374 is a high-severity SQL injection vulnerability in Hongjing e-HR that allows unauthenticated access to sensitive database contents. Defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations to prevent exploitation.

• Verify the presence of the Hongjing e-HR system in your environment and assess exposure to this vulnerability.
• Apply patches or mitigations to prevent exploitation of the SQL injection vulnerability.
• Monitor for suspicious activity related to the getSdutyTree servlet endpoint.

Technical summary

The Hongjing e-HR system contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint. This vulnerability allows remote attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents, including user credentials.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations to prevent exploitation.

Recommended defensive actions

• Verify the presence of the Hongjing e-HR system in your environment and assess exposure to this vulnerability.
• Review and apply patches or mitigations to prevent exploitation of the SQL injection vulnerability.
• Monitor for suspicious activity related to the getSdutyTree servlet endpoint.
• Consider implementing additional security controls to protect against SQL injection attacks.
• Track exceptions and retest remediated assets.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was first observed by the Shadowserver Foundation on 2024-07-30 (UTC). The CVE record and NVD entry provide details on the vulnerability, but the vendor and affected versions are not clearly identified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.