CVE-2022-21687 Command injection in gh-ost
Attackers can read arbitrary files by exploiting unsanitized input in the database parameter of gh-ost, requiring host access or social engineering.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21687?
CVE-2022-21687 is a medium-severity command injection vulnerability in n/a, published on 1 Feb 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads.
Weakness: CWE-20
Which versions are affected by CVE-2022-21687?
3 open source packages ship an affected version, including github.com/github/gh-ost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/github/gh-ost Go | All versions | 1.1.3 |
github.com/github/gh-ost Go | All versions | 1.1.3 |
github.com/github/gh-ost Go | All versions | 1.1.3 |
Products include Github Gh-Ost.
How do I fix CVE-2022-21687?
Upgrade github.com/github/gh-ost to 1.1.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-21687 being exploited?
There is no known exploitation of CVE-2022-21687 in the wild and no public exploit code.
Sources
Also known as GHSA-rrp4-2xx3-mv29, GO-2022-0298.