Log in Start free

Vulnerability · Published May 27, 2024 · Assigned by GitHub_M

CVE-2024-35182GHSL-2024-014 Meshery SQL Injection vulnerability

Medium 5.9

In plain English

A medium-severity SQL injection in meshery from meshery. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)1.6%top 24.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetAllEvents` at the API URL `/api/v2/events`. The sort query parameter read in `events_streamer.go` is directly used to build a SQL query in `events_persister.go`. Version 0.7.22 fixes this issue by using the `SanitizeOrderInput` function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/layer5io/meshery0.7.22GHSA-h7cm-jvpp-69xf
Gogithub.com/layer5io/mesheryno fix listedGO-2024-3051

Affected products (as reported)

VendorProductVersions
meshery meshery < 0.7.22

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

References