PT-2023-25984 · Knowage · Knowage

Davide-Zerbetto + 1 · Published 2023-07-14 · Updated 2023-07-27 · CVE-2023-37472

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Knowage versions prior to 8.1.8

Description Knowage is an open source suite for business analytics that uses user-supplied data to create HQL queries without prior sanitization. An attacker can create specially crafted HQL queries to break subsequent SQL queries generated by the Hibernate engine. The endpoint "/knowage/restful-services/2.0/documents/listDocument" calls the "countBIObjects" method of the "BIObjectDAOHibImpl" object with the user-supplied label parameter without prior sanitization, leading to SQL injection in the backing database. Other injections have been identified in the application as well. An authenticated attacker with low privileges could leverage this issue to retrieve sensitive information from the database, such as account credentials or business information.

Recommendations For versions prior to 8.1.8, upgrade to version 8.1.8 to address the issue. As a temporary workaround, consider restricting access to the "/knowage/restful-services/2.0/documents/listDocument" endpoint and limiting the use of the label parameter until the issue is resolved. Additionally, restrict access to the "countBIObjects" method of the "BIObjectDAOHibImpl" object to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-37472

GHSA-2J3F-F696-7RGJ

Affected Products

Knowage

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37472.json · Exploit
• 🔥 https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-2j3f-f696-7rgj · Exploit
• https://osv.dev/vulnerability/CVE-2023-37472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37472 · Security Note
• https://t.me/cvenotify/54390 · Telegram Post