Full Report
Huntress discovered threat actors abusing a blind SQL injection vulnerability in BillQuick Web Suite. Follow our analysis and latest findings in this blog.
Analysis Summary
# Vulnerability: Blind SQL Injection in BQE BillQuick Web Suite
## CVE Details
- **CVE ID:** CVE-2021-42258
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-89 (SQL Injection)
*Note: Several related CVEs were identified during the investigation (CVE-2021-42344 through CVE-2021-42742), but the primary entry point for the described attacks is CVE-2021-42258.*
## Affected Systems
- **Products:** BQE BillQuick Web Suite
- **Versions:** Multiple versions, specifically including Web Suite 2020 and versions prior to 22.0.9.1.
- **Configurations:** On-premises Windows servers hosting the BillQuick Web Suite application.
## Vulnerability Description
The vulnerability is a **blind SQL injection** flaw located in the application's main login form. Technical analysis revealed that the server-side code utilized concatenated SQL queries. This lack of input sanitization allows an unauthenticated user to control the queries sent to the MSSQL database. Attackers can leverage this to bypass authentication, extract sensitive data, and, in observed cases, achieve Remote Code Execution (RCE) via the `MSSQLSERVER$` service account to run malicious commands on the host OS.
## Exploitation
- **Status:** **Exploited in the wild.** Huntress confirmed threat actors used this flaw to deploy ransomware against a US engineering firm.
- **Complexity:** Low (Automated tools like `sqlmap` can successfully exploit the flaw).
- **Attack Vector:** Network (Remote/Unauthenticated).
## Impact
- **Confidentiality:** High (Full access to BillQuick data and database contents).
- **Integrity:** High (Ability to execute commands and modify data).
- **Availability:** High (Observed deployment of ransomware leading to system lockout).
## Remediation
### Patches
- **Upgrade to WebSuite 2021 version 22.0.9.1** or newer. BQE Software released this update specifically to address the SQL injection flaw.
### Workarounds
- Ensure the principle of least privilege for the MSSQL service account to limit the impact of a potential compromise.
- Restrict access to the BillQuick login portal to known IP addresses via firewall rules or VPN until patches are applied.
## Detection
- **Indicators of Compromise (IoC):**
- High volume of POST requests to the web server logon endpoint from unfamiliar foreign IP addresses.
- Microsoft Defender alerts indicating malicious activity originating from the `MSSQLSERVER$` service account.
- Unexpected deployment of "Ransomware Canary" files or unauthorized encryption activity.
- **Detection Methods:**
- Monitor web server logs for SQL injection patterns (e.g., `' OR 1=1`, `WAITFOR DELAY`, etc.) directed at the login page.
- Audit database logs for unusual queries or administrative commands being executed by the web application service user.
## References
- **Vendor Advisory:** hxxps://billquick[.]net/download/Support_Download/BQWS2021Upgrade/WebSuite2021LogFile_9_1[.]pdf
- **Huntress Analysis:** hxxps://www[.]huntress[.]com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
- **CVE MITRE:** hxxps://cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2021-42258