Vulnerability · Published Jul 12, 2024 · Assigned by GitHub_M

CVE-2024-39909SQL Injection in the KubeClarity REST API

Medium 6.5

In plain English

A medium-severity SQL injection in kubeclarity from openclarity. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 61.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`. As it can be seen in backend/pkg/database/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without the input having first been subjected to any validation. This vulnerability is fixed in 2.23.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/openclarity/kubeclarity/backend	0.0.0-20240711173334-1d1178840703	GHSA-5248-h45p-9pgw
Go	github.com/openclarity/kubeclarity/backend	0.0.0-20240711173334-1d1178840703	GO-2024-2981

Affected products (as reported)

Vendor	Product	Versions
openclarity	kubeclarity	< 2.23.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/openclarity/kubeclarity/security/advisories/GHSA-5248-h45p-9pgw x_refsource_CONFIRM
https://github.com/openclarity/kubeclarity/commit/1d1178840703a72d9082b7fc4aea0a3326c5d294 x_refsource_MISC
https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79 x_refsource_MISC