PT-2024-26362 · Meshery · Meshery

Tony Torralba · Published 2024-05-23 · Updated 2024-08-06 · CVE-2024-35181

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Meshery versions prior to 0.7.22

Description A SQL injection issue may lead to arbitrary file write by using a SQL injection stacked queries payload and the ATTACH DATABASE command. Attackers may be able to access and modify any data stored in the database, including performance profiles, Meshery application data, or Kubernetes configuration. The Meshery project exposes the function GetMeshSyncResourcesKinds at the API endpoint "/api/system/meshsync/resources/kinds". The order query parameter is directly used to build a SQL query in meshync handler.go.

Recommendations For Meshery versions prior to 0.7.22, update to version 0.7.22 to resolve the issue. As a temporary workaround, consider restricting access to the /api/system/meshsync/resources/kinds API endpoint until a patch is available. Avoid using the order query parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-35181

GHSA-9F24-JRV4-F8G5

GO-2024-3050

Affected Products

Meshery

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35181.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-013_GHSL-2024-014_Meshery · Exploit
• https://github.com/meshery/meshery/pull/10207 · Patch
• https://github.com/meshery/meshery/commit/b55f6064d0c6a965aee38f30281f99da7dc4420c · Patch
• https://github.com/meshery/meshery/pull/10280 · Patch
• https://github.com/meshery/meshery/commit/8e995ce21af02d32ef61689c1e1748a745917f13 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-35181 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35181 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3050 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9f24-jrv4-f8g5 · Vendor Advisory
• https://github.com/layer5io/meshery · Note
• https://github.com/meshery/meshery/blob/b331f45c9083d7abf6b90105072b04cd22473de7/server/handlers/meshsync_handler.go#L187 · Note
• https://github.com/advisories/GHSA-9f24-jrv4-f8g5 · Note
• https://twitter.com/GHSecurityLab/status/1793685336679153777 · Twitter Post
• https://t.me/cvenotify/81098 · Telegram Post