PT-2023-22781 · Archery · Archery

Sylwia-Budzynska · Published 2023-04-18 · Updated 2023-05-01 · CVE-2023-30554

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Archery (affected versions not specified)

Description The Archery project contains multiple SQL injection issues that may allow an attacker to query connected databases. The sql api/api workflow.py endpoint ExecuteCheck passes unfiltered input to the explain check method in sql/engines/oracle.py. User input from the db name parameter in the api workflow.py ExecuteCheck endpoint is executed through the oracle.py execute check method and the explain check method. These issues can be mitigated by escaping user input or using prepared statements when executing SQL queries.

Recommendations As a temporary workaround, consider escaping user input or using prepared statements when executing SQL queries to mitigate the risk of exploitation. Restrict access to the sql api/api workflow.py endpoint ExecuteCheck to minimize the risk of exploitation. Avoid using the db name parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-30554

GHSA-3P43-89M6-7X5W

Affected Products

Archery

References · 5

• 🔥 https://github.com/hhyo/Archery/security/advisories/GHSA-3p43-89m6-7x5w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30554.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-30554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30554 · Security Note
• https://t.me/cibsecurity/62440 · Telegram Post