PT-2023-22780 · Archery · Archery

Sylwia-Budzynska

·

Published

2023-04-18

·

Updated

2023-05-01

·

CVE-2023-30553

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Archery (affected versions not specified)
Description The Archery project contains multiple SQL injection vulnerabilities that may allow an attacker to query the connected databases. User input coming from the db name parameter value and the full sql parameter value in the api workflow.py ExecuteCheck endpoint is passed to the methods that follow in given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the query method of each database engine for execution. The affected methods are execute check in sql/engines/clickhouse.py, execute check in sql/engines/goinception.py, and execute check in sql/engines/oracle.py. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries.
Recommendations As a temporary workaround, consider disabling the execute check function in sql/engines/clickhouse.py, sql/engines/goinception.py, and sql/engines/oracle.py until a patch is available. Restrict access to the sql api/api workflow.py endpoint ExecuteCheck to minimize the risk of exploitation. Avoid using the parameters db name and full sql in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-30553
GHSA-HVCQ-R2R2-34CH

Affected Products

Archery