PT-2023-25720 · Sqlfluff+1 · Sqlfluff+1

Dan Amodio · Published 2023-07-06 · Updated 2023-07-13 · CVE-2023-36830

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SQLFluff versions prior to 2.1.2

Description In environments where untrusted users have access to the config files, there is a potential security issue where those users could use the library path config value to allow arbitrary python code to be executed via macros. This may not be an issue for users with already escalated privileges, but it could be a problem in larger user bases or where SQLFluff is bundled into another tool. The library path argument can be used to execute arbitrary python code, and an example of how an external URL might be called to reveal internal information is provided.

Recommendations For versions prior to 2.1.2, use the option --library-path none when invoking SQLFluff to disable the library-path option entirely. As a temporary workaround, limit access to or validate configuration files before they are ingested by SQLFluff. For version 2.1.2 and later, no additional action is required as the --library-path option can be used to override any values provided in the config files.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-36830

GHSA-JQHC-M2J3-FJRX

PYSEC-2023-111

Affected Products

Debian

Sqlfluff

References · 16

• 🔥 https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-jqhc-m2j3-fjrx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36830.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36830 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-36830 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqhc-m2j3-fjrx · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-36830 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-111 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-36830 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36830 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-36830 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-36830 · Security Note
• https://github.com/sqlfluff/sqlfluff · Note
• https://github.com/sqlfluff/sqlfluff/releases/tag/2.1.2 · Note
• https://github.com/sqlfluff/sqlfluff/commit/6cdc38d76bedab4801b035c04d3c2b3aea17de86 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/sqlfluff/PYSEC-2023-111.yaml · Note