PT-2017-18803 · New Relic · New Relic .Net Agent

Publicado 2017-06-13 · Atualizado 2022-05-17 · CVE-2017-9246

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions New Relic .NET Agent versions prior to 6.3.123.0

Description The issue involves SQL injection flaws in safe applications due to the failure to escape quotes during the use of the Slow Queries feature. This can be demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, which can occur after bypassing a SET SHOWPLAN ALL ON protection mechanism.

Recommendations For versions prior to 6.3.123.0, update to version 6.3.123.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Slow Queries feature until a patch is applied. Avoid using the Slow Queries feature with user-inputted data to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-9246

GHSA-2RVX-CVFC-MCP2

Produtos afetados

New Relic .Net Agent

Referências · 6

• 🔥 https://blog.seanmcelroy.com/2017/05/26/sql-injection-with-new-relic-patched · Exploit
• https://github.com/newrelic/newrelic-dotnet-agent · Nota
• https://osv.dev/vulnerability/CVE-2017-9246 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2rvx-cvfc-mcp2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9246 · Nota de Segurança
• https://web.archive.org/web/20221202191459/https://blog.seanmcelroy.com/2017/05/26/sql-injection-with-new-relic-patched · Nota