SQL injection for certain queries with variables #392
Comments
This was referenced Apr 20, 2022
jeremyf
added a commit
to forem/forem
that referenced
this issue
Apr 21, 2022
Prior to this commit, we were seeing the following: ```console ❯ bundle exec bundle-audit check --update Updating ruby-advisory-db ... From https://github.com/rubysec/ruby-advisory-db * branch master -> FETCH_HEAD Already up to date. Updated ruby-advisory-db ruby-advisory-db: advisories: 562 advisories last updated: 2022-04-20 14:56:09 -0700 commit: 1cca55530261d16f4cd16691c1ebbae86c91c28b Name: blazer Version: 2.5.0 CVE: CVE-2022-29498 Criticality: Unknown URL: ankane/blazer#392 Title: SQL injection for certain queries with variables Solution: upgrade to >= 2.6.0 Vulnerabilities found! ``` Blocking #17382
jeremyf
added a commit
to forem/forem
that referenced
this issue
Apr 21, 2022
Prior to this commit, we were seeing the following: ```console ❯ bundle exec bundle-audit check --update Updating ruby-advisory-db ... From https://github.com/rubysec/ruby-advisory-db * branch master -> FETCH_HEAD Already up to date. Updated ruby-advisory-db ruby-advisory-db: advisories: 562 advisories last updated: 2022-04-20 14:56:09 -0700 commit: 1cca55530261d16f4cd16691c1ebbae86c91c28b Name: blazer Version: 2.5.0 CVE: CVE-2022-29498 Criticality: Unknown URL: ankane/blazer#392 Title: SQL injection for certain queries with variables Solution: upgrade to >= 2.6.0 Vulnerabilities found! ``` Blocking #17382
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Blazer queries with variables are vulnerable to SQL injection in certain cases. This vulnerability has been assigned the CVE identifier CVE-2022-29498.
Versions Affected: 2.5.0 and below
Fixed Versions: 2.6.0
Impact
For some queries, specific variable values can modify the query rather than just the variable. This can occur if:
Since Blazer is designed to run arbitrary queries, the impact will typically be low. Users cannot run any queries they could not have already run. However, an attacker could get a user to run a query they would not have normally run. If the data source has write permissions, this could include modifying data in some cases.
Mitigation
All users running an affected release should upgrade when possible.
Blazer now uses parameterized queries or prepared statements for variables for a number of data sources, which mitigates the issue for their queries. Escaping has been fixed for the other data sources, but it's still possible for users to write queries that can't be escaped correctly, like
SELECT '{var}'. For this reason, data sources should use credentials with read-only permissions.Credit
Thanks to Al Chou for reporting the escaping issue.
The text was updated successfully, but these errors were encountered: