GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}

CVE-2024-42361

Summary

Hertzbeat, an open-source real-time monitoring system, is susceptible to a SQL injection vulnerability in its API. The flaw exists in versions 1.6.0 and earlier, specifically within the /api/monitor/{monitorId}/metric/{metricFull} endpoint. This endpoint allows users to download job metrics and executes a SQL query using data from user inputs without sufficient validation. Consequently, attackers can manipulate the input parameters, potentially compromising the integrity and confidentiality of the database. Proper security measures should be applied to validate and sanitize all user inputs to mitigate the risk associated with this vulnerability.

References