PT-2022-23173 · Arangodb+1 · Arangodb+1

Yogu · Published 2022-09-08 · Updated 2023-06-29 · CVE-2022-36084

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cruddl versions 1.1.0 through 2.6.x cruddl versions 3.0.0 through 3.0.1

Description The issue affects cruddl when used to generate a schema that uses @flexSearchFulltext. Users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use @flexSearchFulltext are not affected. The attacker needs to have READ permission to at least one root entity type that has @flexSearchFulltext enabled.

Recommendations For cruddl versions 1.1.0 through 2.6.x, update to version 2.7.0 to resolve the issue. For cruddl versions 3.0.0 through 3.0.1, update to version 3.0.2 to resolve the issue. As a temporary workaround, consider removing @flexSearchFulltext from your schemas until you can update cruddl.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-943

CWE-74

Related Identifiers

CVE-2022-36084

GHSA-QM4W-4995-VG7F

Affected Products

Arangodb

Cruddl

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36084.json · Exploit
• https://github.com/AEB-labs/cruddl/pull/253 · Patch
• https://github.com/AEB-labs/cruddl/security/advisories/GHSA-qm4w-4995-vg7f · Vendor Advisory
• https://github.com/AEB-labs/cruddl/commit/13b9233733ed6fc822718a07bc90a80cd3492698 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36084 · Security Note
• https://osv.dev/vulnerability/GHSA-qm4w-4995-vg7f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36084 · Vendor Advisory
• https://github.com/AEB-labs/cruddl · Note
• https://t.me/cvenotify/53316 · Telegram Post
• https://t.me/cvenotify/35913 · Telegram Post
• https://t.me/cvenotify/35917 · Telegram Post