PT-2023-22194 · Vitess+2 · Vitess+2

Adamkorcz · Published 2023-05-11 · Updated 2023-05-22 · CVE-2023-29195

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Vitess versions prior to 16.0.2

Description The issue allows users to create a shard containing / characters from VTAdmin, which can cause errors when trying to create new shards or view keyspaces. Creating a shard using vtctldclient does not have the same problem because the CLI validates the input correctly.

Recommendations For versions prior to 16.0.2, consider the following workarounds: Always use vtctldclient to create shards, instead of using VTAdmin. Disable creating shards from VTAdmin using RBAC. Delete the topology record for the offending shard using the client for your topology server. Update to version 16.0.2 or later, which contains a patch for this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-703

Related Identifiers

AZL-26696

CVE-2023-29195

GHSA-PQJ7-JX24-WJ7W

Affected Products

Vtadmin

Vitess

Vtctldclient

References · 14

• 🔥 https://github.com/vitessio/vitess/issues/12842 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29195.json · Exploit
• https://github.com/vitessio/vitess/commit/9dcbd7de3180f47e94f54989fb5c66daea00c920 · Patch
• https://github.com/vitessio/vitess/security/advisories/GHSA-pqj7-jx24-wj7w · Vendor Advisory
• https://github.com/vitessio/vitess/pull/12843 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-29195 · Security Note
• https://osv.dev/vulnerability/AZL-26696 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29195 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pqj7-jx24-wj7w · Vendor Advisory
• https://github.com/vitessio/vitess · Note
• https://github.com/vitessio/vitess/releases/tag/v16.0.2 · Note
• https://pkg.go.dev/vitess.io/vitess@v0.16.2 · Note
• https://t.me/cvenotify/50252 · Telegram Post
• https://t.me/cibsecurity/63923 · Telegram Post