PT-2021-22437 · Dhis2 · Dhis2

Philip-Larsen-Donnelly · Published 2021-10-29 · Updated 2021-11-03 · CVE-2021-39179

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DHIS2 versions 2.32 through 2.36

Description A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecified vectors, affecting the "/api/trackedEntityInstances" and "/api/trackedEntityInstances/query" API endpoints. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance.

Recommendations For versions 2.32 and 2.33, upgrade to the latest end of support builds, 2.32-EOS and 2.33-EOS, respectively. For versions 2.34, 2.35, and 2.36, upgrade to versions 2.34.7, 2.35.7, and 2.36.4, respectively. As a temporary workaround for implementations that do not use Tracker functionality, consider blocking all network access to POST requests to the "/api/trackedEntityInstances" and "/api/trackedEntityInstances/query" endpoints.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-39179

GHSA-CMPC-FRJV-RRMW

Affected Products

Dhis2

References · 6

• 🔥 https://github.com/dhis2/dhis2-core/security/advisories/GHSA-cmpc-frjv-rrmw · Exploit
• https://github.com/dhis2/dhis2-core/commit/16674ac75127b0e83691c6b1c9ce745e67ab58b6 · Patch
• https://github.com/dhis2/dhis2-core/pull/8771 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39179 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39179 · Vendor Advisory
• https://t.me/cibsecurity/31462 · Telegram Post