CVE-2023-44450

What it actually does

The flaw is a SQL injection in the getNodesByTopologyMapSearch functionality caused by insufficient validation of a user-controlled string before it is concatenated into SQL queries. A low-privileged authenticated remote attacker can manipulate the query, interact with the backend database beyond the intended application logic, and, per the vulnerability description, escalate the impact to arbitrary code execution in the context of SYSTEM. Because the CVSS vector is network-accessible, low-complexity, requires no user interaction, and has high confidentiality, integrity, and availability impact, successful exploitation can result in full compromise of the affected application host.

Why it matters to the business

A successful attack can turn a compromised low-privilege application account into complete control of the management server, allowing attackers to steal network-management data, alter monitored device information, deploy malicious changes, disrupt operations, or use the server as a foothold into the broader network. The EPSS score is elevated, indicating meaningful exploitation likelihood even though it is not currently listed in CISA KEV and no ransomware use is reported. The issue has been public for a long period, so unpatched systems should be treated as high-risk exposure.

How an attack unfolds

An attacker first obtains or reuses valid credentials for the affected management application. After authenticating, the attacker sends a crafted request to the feature that invokes getNodesByTopologyMapSearch, placing SQL control characters or database-specific expressions into the vulnerable search parameter. Because the application fails to safely parameterize or validate the input, the injected content is executed by the database as part of the query. The attacker can use this access to enumerate data, modify records, or invoke database capabilities that enable command execution. In the worst case described for this vulnerability, the attacker achieves arbitrary code execution as SYSTEM, giving them full control of the underlying Windows host and the ability to persist, exfiltrate data, or pivot further.

How to fix it

Upgrade affected software to a fixed version as soon as possible. For the package data provided, cloud-hypervisor/cloud-hypervisor Git is fixed in commit 93d7e01b417d8192707fefe04012bb68c096947b. If operating NETGEAR ProSAFE Network Management System installations matching the vulnerability description, apply the vendor-provided security update or supported replacement version that remediates the getNodesByTopologyMapSearch SQL injection. Until patching is complete, restrict access to the management interface to trusted administrative networks or VPNs, enforce strong authentication and MFA where available, remove unused accounts, reduce database/application privileges, and monitor for SQL injection attempts. Where compensating controls are needed, deploy WAF or reverse-proxy rules to block obvious SQL metacharacter abuse against the vulnerable functionality, but do not treat filtering as a substitute for patching.

How to confirm the fix worked

Confirm that all affected installations have been upgraded to a fixed build or include commit 93d7e01b417d8192707fefe04012bb68c096947b where applicable. Validate exposure by inventorying reachable management interfaces and checking software version/build information against vendor advisories and fixed-version metadata. Perform an authenticated, authorized security test against the getNodesByTopologyMapSearch functionality using benign SQL injection probes that do not alter data, and confirm that payloads are rejected, parameterized, or logged without changing query behavior. Review database permissions to verify the application account cannot execute operating system commands or perform unnecessary high-risk operations. Confirm network controls prevent untrusted access to the management interface.

Typical attack path

1. Identify an exposed or reachable affected management interface.
2. Acquire valid application credentials through phishing, credential reuse, password spraying, or abuse of an existing low-privileged account.
3. Authenticate to the application.
4. Send a crafted request to functionality that calls getNodesByTopologyMapSearch with SQL injection payloads in a user-controlled search value.
5. Use SQL injection to confirm database control, enumerate schema or sensitive records, and bypass intended query constraints.
6. Escalate from database manipulation to operating system command execution where supported by the backend database and application configuration.
7. Run commands as SYSTEM on the affected host, establish persistence, collect credentials or configuration data, and pivot to managed network assets.

How to detect it

To determine whether exploitation already occurred, correlate application access logs, authentication logs, database logs, and endpoint telemetry from the application host. Focus on authenticated requests to getNodesByTopologyMapSearch containing SQL metacharacters, comments, UNION/SELECT expressions, stacked queries, time-delay functions, or database command-execution primitives. Review failed and successful login activity preceding suspicious requests, especially from unusual IP addresses or low-privilege accounts. Check application and database logs for SQL syntax errors, abnormal long-running queries, unexpected schema enumeration, use of xp_cmdshell or equivalent command-execution features, and database permission changes. On Windows hosts, inspect process creation logs for command shells or scripting engines launched by the application service, database service, Java/Tomcat service, or web server process. Investigate creation of new local users, changes to administrator groups, dropped executables or scripts in application directories and temporary folders, outbound connections shortly after suspicious requests, and evidence of credential dumping or lateral movement.

• getNodesByTopologyMapSearch
• UNION SELECT
• UNION ALL SELECT
• SLEEP(
• BENCHMARK(
• WAITFOR DELAY
• pg_sleep(
• --
• /*
• */
• ' OR '1'='1
• " OR "1"="1
• ;SELECT
• ; EXEC
• xp_cmdshell
• sp_configure 'xp_cmdshell'
• INFORMATION_SCHEMA
• sys.objects
• sys.tables
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• rundll32.exe
• regsvr32.exe
• net user
• net localgroup administrators

What your security team should do

• Prioritize patching or removal from service for any internet-accessible or broadly reachable affected management servers.
• Inventory all deployments of the affected product/functionality and verify whether they are running a fixed build or the fixed Git commit 93d7e01b417d8192707fefe04012bb68c096947b where applicable.
• Treat any unpatched system with suspicious authenticated activity against getNodesByTopologyMapSearch as potentially compromised and begin incident response triage.
• Restrict administrative and management interfaces to trusted networks, VPNs, or bastion hosts only.
• Review application accounts for unnecessary privileges and rotate credentials for accounts that have accessed affected systems.
• Enable or increase logging for web requests, authentication events, database errors, database audit events, and process creation on the application host.
• Search historical logs for SQL injection payloads, database error leakage, suspicious command execution, and unexpected child processes spawned by the application or database service.
• Deploy detection rules for SQL injection patterns targeting getNodesByTopologyMapSearch and alert on any successful request followed by abnormal database or OS activity.