PT-2024-28725 · Unknown · Kubeclarity

Published 2024-07-12 · Updated 2024-07-12 · CVE-2024-39909

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions KubeClarity versions prior to 2.23.1

Description A time/boolean SQL Injection is present in the /api/applicationResources resource via the packageID parameter. The vulnerability occurs because the fmt.Sprintf function is used to build the SQL query string without validating the input. This issue is limited to read access to the KubeClarity database when using the Helm chart, but it may allow access to more data than expected if KubeClarity is deployed in a less secure way.

Recommendations For versions prior to 2.23.1, update to version 2.23.1 to resolve the issue. As a temporary workaround, consider restricting access to the /api/applicationResources endpoint or validating the packageID parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-39909

GHSA-5248-H45P-9PGW

GO-2024-2981

Affected Products

Kubeclarity

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39909.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-39909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39909 · Security Note
• https://osv.dev/vulnerability/GO-2024-2981 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5248-h45p-9pgw · Vendor Advisory
• https://github.com/openclarity/kubeclarity/security/advisories/GHSA-5248-h45p-9pgw · Note
• https://github.com/openclarity/kubeclarity/commit/1d1178840703a72d9082b7fc4aea0a3326c5d294 · Note
• https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79 · Note
• https://github.com/openclarity/kubeclarity · Note
• https://t.me/cvedetector/762 · Telegram Post