Log in Start free

Vulnerability · Published May 27, 2024 · Assigned by GitHub_M

CVE-2024-35181GHSL-2024-013 Meshery SQL Injection vulnerability

Medium 5.9

In plain English

A medium-severity SQL injection in meshery from meshery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)1.6%top 24.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API URL `/api/system/meshsync/resources/kinds`. The order query parameter is directly used to build a SQL query in `meshync_handler.go`. Version 0.7.22 fixes this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/layer5io/meshery0.7.22GHSA-9f24-jrv4-f8g5
Gogithub.com/layer5io/mesheryno fix listedGO-2024-3050

Affected products (as reported)

VendorProductVersions
meshery meshery < 0.7.22

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

References