PT-2023-22779 · Archery · Archery

Sylwia-Budzynska · Published 2023-04-18 · Updated 2023-05-01 · CVE-2023-30552

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Archery (affected versions not specified)

Description The Archery project contains multiple SQL injection vulnerabilities that may allow an attacker to query the connected databases. The issue arises from the sql/instance.py endpoint's describe method, where user input from the tb name parameter value, the db name parameter value, or the schema name value is passed to the describe table methods in various SQL engine implementations. These methods concatenate user input unsafely into a SQL query and pass it to the query method of each database engine for execution. The affected methods include describe table in sql/engines/clickhouse.py, sql/engines/mssql.py, sql/engines/mysql.py, sql/engines/oracle.py, sql/engines/pgsql.py, and sql/engines/phoenix.py. This issue may be mitigated by escaping user input or using prepared statements when executing SQL queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-30552

GHSA-9JVJ-8H33-6CQP

Affected Products

Archery

References · 6

• 🔥 https://github.com/hhyo/Archery/security/advisories/GHSA-9jvj-8h33-6cqp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30552.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-30552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30552 · Security Note
• https://t.me/cibsecurity/62436 · Telegram Post
• https://t.me/cvenotify/49522 · Telegram Post