PT-2017-18803 · New Relic · New Relic .Net Agent

Published 2017-06-13 · Updated 2022-05-17 · CVE-2017-9246

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions New Relic .NET Agent versions prior to 6.3.123.0

Description The issue involves SQL injection flaws in safe applications due to the failure to escape quotes during the use of the Slow Queries feature. This can be demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, which can occur after bypassing a SET SHOWPLAN ALL ON protection mechanism.

Recommendations For versions prior to 6.3.123.0, update to version 6.3.123.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Slow Queries feature until a patch is applied. Avoid using the Slow Queries feature with user-inputted data to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-9246

GHSA-2RVX-CVFC-MCP2

Affected Products

New Relic .Net Agent

References · 6

• 🔥 https://blog.seanmcelroy.com/2017/05/26/sql-injection-with-new-relic-patched · Exploit
• https://osv.dev/vulnerability/CVE-2017-9246 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rvx-cvfc-mcp2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9246 · Security Note
• https://github.com/newrelic/newrelic-dotnet-agent · Note
• https://web.archive.org/web/20221202191459/https://blog.seanmcelroy.com/2017/05/26/sql-injection-with-new-relic-patched · Note