cruddl up to 2.6.x/3.0.1 Schema data query logic injection

Summaryinfo

A vulnerability has been found in cruddl up to 2.6.x/3.0.1 and classified as critical. This affects an unknown part of the component Schema Handler. Performing a manipulation results in data query logic injection. This vulnerability is known as CVE-2022-36084. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in cruddl up to 2.6.x/3.0.1. This affects an unknown part of the component Schema Handler. The manipulation with an unknown input leads to a data query logic injection vulnerability. CWE is classifying the issue as CWE-943. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas.

The weakness was published 09/09/2022 as GHSA-qm4w-4995-vg7f. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2022-36084 since 07/15/2022. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 2.7.0 or 3.0.2 eliminates this vulnerability. Applying the patch 13b9233733ed6fc822718a07bc90a80cd3492698 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• cruddl

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 3.0.0
• 3.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion