CVE-2020-9483 SQL injection in Apache SkyWalking

High 7.5 Published 30 Jun 2020 Updated 4 Aug 2024

SQL injection in Apache SkyWalking GraphQL metadata queries allows attackers to access unexpected data when using H2, MySQL, or TiDB storage.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-9483?

CVE-2020-9483 is a high-severity SQL injection vulnerability in Apache SkyWalking, published on 30 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.

Weakness: CWE-89

Which versions are affected by CVE-2020-9483?

It affects 1 product.

Products include Apache Skywalking.

How do I fix CVE-2020-9483?

No fix has been published for CVE-2020-9483 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2020-9483 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-9483 exists.

Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.

Sources

Also known as GHSA-p9p3-c9pg-xjrh.