Researchers found several points of entry for potential attackers, one of which was Apple’s Book Travel portal, where they took advantage of a significant SQL injection vulnerability.
Experimenting with the Masa/Mura CMS revealed the attack surface, primarily the one available within Apple’s environment.
The JSON API was the main focus because it provides access to certain functions available within Apple’s environment. A JSON API should be the source of any potentially susceptible sink researchers discover.
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
In a blog post in ProjectDiscovery Cloud Platform, researchers explain how they focused SQL injection sink detection.
A critical condition in the dspObjects function was found by researchers. An if condition needs to be met before invoking getObjects: the Mura servlet event handler’s isOnDisplay property needs to be set to true.
At first, researchers thought that any property on the event handler could be set by just providing the property name and value as parameters. Their debugging session inside the codebase served as the foundation for this hypothesis.
The previewID property can be set to any value by supplying it as an argument, and this will cause the isOnDisplay property to be set to true.
“Since this was an error-based SQL injection, we could exploit it quite easily to achieve Remote Code Execution (RCE). Locally, we successfully performed RCE”, researchers said.
Researchers used these procedures to successfully conduct RCE:
The researchers duly shared the findings with Apple and the corresponding Masa and Mura CMS teams.
Apple promptly addressed the stated issue by responding and implementing a fix within two hours of the initial report.
Masa is an open-source fork of Mura CMS; they released a fixed version of Masa CMS with great transparency.
The most recent security fixes, which address another critical pre-auth SQL injection and have been assigned CVE (CVE-2024-32640), are included in the 7.4.6, 7.3.13, and 7.2.8 versions.
After many attempts to contact the Mura team about these vulnerabilities via various communication methods, no response was received.
Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide
A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…
A threat actor known as #LongNight has reportedly put up for sale remote code execution…
Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…
Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…
The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…
Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…