SQL Injection Vulnerability in Meshery Prior to Version 0.7.22
CVE-2024-35181

5.9MEDIUM

Key Information:

Vendor

Meshery

Status
Meshery
Vendor
CVE Published:
27 May 2024

What is CVE-2024-35181?

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function GetMeshSyncResourcesKinds at the API URL /api/system/meshsync/resources/kinds. The order query parameter is directly used to build a SQL query in meshync_handler.go. Version 0.7.22 fixes this issue.

Affected Version(s)

meshery < 0.7.22

References

https://securitylab.github.com/advisories/GHSL-2024-013_G...
x_refsource_CONFIRM
https://github.com/meshery/meshery/pull/10207
x_refsource_MISC
https://github.com/meshery/meshery/pull/10280
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.