CVE-2024-35181

CVSS V2 None CVSS V3 None

Description

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API URL `/api/system/meshsync/resources/kinds`. The order query parameter is directly used to build a SQL query in `meshync_handler.go`. Version 0.7.22 fixes this issue.

Overview

CVE ID
CVE-2024-35181

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-05-27T18:18:37.054Z

Last Modified Date
2024-06-04T17:34:46.445Z

Weakness Enumerations

CWE	URL
CWE-89	http://cwe.mitre.org/data/definitions/89.html

References

Reference URL	Reference Tags
https://securitylab.github.com/advisories/GHSL-2024-013_GHSL-2024-014_Meshery/	x_refsource_CONFIRM
https://github.com/meshery/meshery/pull/10207	x_refsource_MISC
https://github.com/meshery/meshery/pull/10280	x_refsource_MISC
https://github.com/meshery/meshery/commit/8e995ce21af02d32ef61689c1e1748a745917f13	x_refsource_MISC
https://github.com/meshery/meshery/commit/b55f6064d0c6a965aee38f30281f99da7dc4420c	x_refsource_MISC
https://github.com/meshery/meshery/blob/b331f45c9083d7abf6b90105072b04cd22473de7/server/handlers/meshsync_handler.go#L187	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-35181
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35181

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 13:54:42				Added to TrackCVE