PT-2023-21711 · Soko · Soko

Thomas-Chauchefoin-Sonarsource

·

Publicado

2023-03-20

·

Atualizado

2024-12-12

·

CVE-2023-28424

CVSS v3.1

9.1

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions Soko versions prior to 1.0.2
Description The issue affects the package search handlers, Search and SearchFeed, implemented in pkg/app/handler/packages/search.go, allowing unauthenticated attackers to execute arbitrary SQL queries on https://packages.gentoo.org/ via the q parameter. This can lead to code execution in the context of the PostgreSQL container. The issue was addressed using prepared statements to interpolate user-controlled data in SQL queries.
Recommendations For versions prior to 1.0.2, update to version 1.0.2 or later, which includes the fix for the SQL injection issue by using prepared statements to interpolate user-controlled data in SQL queries. As a temporary workaround, consider restricting access to the Search and SearchFeed handlers until the update can be applied. Avoid using the q parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-28424
GHSA-GC2X-86P3-MXG2

Produtos afetados

Soko