MindsDB up to 24.7.4.0 Microsoft Sharepoint Integration eval injection

Summaryinfo

A vulnerability marked as very critical has been reported in MindsDB up to 24.7.4.0. This issue affects some unknown processing of the component Microsoft Sharepoint Integration. Performing a manipulation results in eval injection. This vulnerability is identified as CVE-2024-45849. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical has been found in MindsDB up to 24.7.4.0. This affects an unknown code of the component Microsoft Sharepoint Integration. The manipulation with an unknown input leads to a eval injection vulnerability. CWE is classifying the issue as CWE-95. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.

The advisory is shared at hiddenlayer.com. This vulnerability is uniquely identified as CVE-2024-45849 since 09/10/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/12/2024).

Upgrading to version 24.7.4.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• MindsDB

Version

• 24.7.0
• 24.7.1
• 24.7.2
• 24.7.3
• 24.7.4.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion