Vulnerability · Published Jul 9, 2024 · Assigned by GitHub_M

CVE-2024-38363Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte

High 8.6

In plain English

A high-severity security flaw in airbyte from airbytehq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.7%top 47.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new connectors. Sensitive information, such as credentials, could be exposed if a user tested a new connector on a compromised instance. The connection builder does not have access to any data processes. This vulnerability is fixed in 0.62.2.

Affected products (as reported)

Vendor	Product	Versions
airbytehq	airbyte	< 0.62.2

Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/airbytehq/airbyte/security/advisories/GHSA-4j3c-fgvx-xgqq x_refsource_CONFIRM