x/vulndb: potential Go vuln in github.com/openclarity/kubeclarity/backend: GHSA-5248-h45p-9pgw

[GoVulnBot]

Advisory GHSA-5248-h45p-9pgw references a vulnerability in the following Go modules:

Module
github.com/openclarity/kubeclarity/backend

Description:

Summary

A time/boolean SQL Injection is present in the following resource /api/applicationResources via the following parameter packageID

Details

As it can be seen here, while building the SQL Query the fmt.Sprintf function is used to build the query string without the input having first been subjected to any validation.

PoC

The following command should be able to trigger a basic version of the behavior:
`curl -i -s -k -X $'GET'
-H $'Host: kubeclarity.test'
$'https://kube...

References:

• ADVISORY: GHSA-5248-h45p-9pgw
• ADVISORY: GHSA-5248-h45p-9pgw
• FIX: openclarity/kubeclarity@1d11788
• WEB: https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79

Cross references:
No existing reports found with this module or alias.
See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/openclarity/kubeclarity/backend
      versions:
        - fixed: 0.0.0-20240711173334-1d1178840703
summary: SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend
cves:
    - CVE-2024-39909
ghsas:
    - GHSA-5248-h45p-9pgw
references:
    - advisory: https://github.com/advisories/GHSA-5248-h45p-9pgw
    - advisory: https://github.com/openclarity/kubeclarity/security/advisories/GHSA-5248-h45p-9pgw
    - fix: https://github.com/openclarity/kubeclarity/commit/1d1178840703a72d9082b7fc4aea0a3326c5d294
    - web: https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79
notes:
    - fix: 'github.com/openclarity/kubeclarity/backend: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
source:
    id: GHSA-5248-h45p-9pgw
    created: 2024-07-12T14:01:53.440983588Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/597995 mentions this issue: data/reports: add 3 reports

[gopherbot]

Change https://go.dev/cl/606359 mentions this issue: data/reports: regenerate 50 reports