PT-2020-20693 · H2+4 · H2+4

Wu-Sheng · Published 2020-06-30 · Updated 2021-07-20 · CVE-2020-9483

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache SkyWalking versions 6.0.0 through 6.6.0 Apache SkyWalking version 7.0.0

Description The issue is related to a SQL injection vulnerability when using H2, MySQL, or TiDB as storage for Apache SkyWalking. This vulnerability occurs during metadata queries through the GraphQL protocol, allowing access to unexpected data. The storage implementations for H2, MySQL, and TiDB in the affected versions do not properly set SQL parameters.

Recommendations For Apache SkyWalking versions 6.0.0 through 6.6.0, update to a version that uses the appropriate method to set SQL parameters. For Apache SkyWalking version 7.0.0, update to a version that uses the appropriate method to set SQL parameters. As a temporary workaround, consider restricting access to the GraphQL protocol for metadata queries until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-9483

Affected Products

Apache Skywalking

Graphql

H2

Mysql Server

Tidb

References · 7

• 🔥 https://github.com/Neko2sh1ro/CVE-2020-9483 · Exploit
• 🔥 https://github.com/Neko-chanQwQ/CVE-2020-9483 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9483 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9483 · Vendor Advisory
• https://github.com/apache/skywalking/pull/4639 · Note
• https://t.me/cvenotify/4745 · Telegram Post
• https://t.me/cybersecuritytechnologies/3879 · Telegram Post