External risk intelligence

GFast OrderBy SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-55160

The vulnerability exists in a web application management endpoint (/system/operLog/list) designed for handling system logs. Such administrative and operational log interfaces in web applications are frequently exposed or reachable within the application's web surface, making them likely to be accessible in typical network deployments of this software.

SQL Injection

G Fast Gfast

2 to 3.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in GFast software, specifically affecting versions between 2 and 3.2. This issue involves a SQL injection flaw in the OrderBy parameter, which could allow unauthorized access and manipulation of data if exploited. The main concern is to confirm if our organization utilizes this software and assess any potential exposure.

SQL injection flaw in GFast software.
Critical severity, potential for significant data compromise.
Confirm GFast usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by accessing the OrderBy parameter in the /system/operLog/list endpoint. This endpoint is part of the system's operational log functionality and is exposed on the network, requiring no authentication. If an attacker can send a specially crafted request to this endpoint, they could potentially execute arbitrary SQL commands, leading to unauthorized data access or modification.

Accessible via network, no authentication needed.
Triggered by manipulating the OrderBy parameter.
Risk of unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated attacker to manipulate database queries through the OrderBy parameter in the /system/operLog/list endpoint. This could potentially lead to unauthorized access to or modification of system operational logs, affecting service integrity.

System operational logs could be affected.
Malicious input could be sent to the server.
Service integrity may be compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application or platform team managing the g-fast deployment is responsible for addressing this SQL injection vulnerability. The initial focus should be on identifying all instances of g-fast, determining their network exposure, and confirming business criticality. Subsequently, owners of affected systems should be identified to plan remediation, potentially involving vendor coordination or the application of temporary risk reduction measures based on the assessed impact.

Application or platform team owns the issue.
Verify network exposure and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GFast and how is it used?

GFast is a software application or framework used to build and manage web-based systems. It often includes administrative features for monitoring and tracking system operations. The affected versions, 2 through 3.2, provide functionality that handles logs and other backend data tasks required for maintaining platform visibility.

What does CVE-2024-55160 mean in plain English?

This is a SQL injection vulnerability, categorized as CWE-89. It means the software does not properly filter information entered by a user before including it in a database command. Because the application fails to distinguish between legitimate data and malicious commands, an attacker can trick the system into running unauthorized queries, potentially exposing or altering sensitive information stored in the database.

How is this GFast vulnerability triggered?

The flaw is triggered by sending a specially crafted request to the /system/operLog/list endpoint while manipulating the 'OrderBy' parameter. It does not require any prior authentication, meaning an attacker does not need to log in to the system to attempt the attack. Simply interacting with this specific parameter on that endpoint is sufficient to reach the vulnerable code path.

Do I need to worry if my GFast instance is internal?

Yes, it is a concern. While internet-facing instances are more easily accessed by external threats, Halo Surface Signal notes that this log interface is often exposed across typical network deployments. Even if internal, any user or compromised machine within your network could potentially reach the endpoint and exploit this flaw to interact with your system database.

What should I do first to address this?

Begin by creating a comprehensive inventory to locate all active GFast installations within your environment. Once identified, work with your infrastructure or application teams to assess whether these instances are reachable over your network. Prioritize these findings based on the sensitivity of the data the specific instance handles, and coordinate with your technical team to plan for updates or necessary risk mitigation steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.