CVE-2022-23510 SQl injection in cube-js
Authenticated users can bypass row-level security and execute arbitrary SQL queries via the sql-runner endpoint in cube-js.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23510?
CVE-2022-23510 is a critical SQL injection vulnerability in cube-js cube.js, published on 9 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade to 0.31.24 or to downgrade to 0.31.22. There are no known workarounds for this vulnerability.
Weakness: CWE-89
Which versions are affected by CVE-2022-23510?
2 open source packages ship an affected version, including @cubejs-backend/api-gateway. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@cubejs-backend/api-gateway npm | From 0.31.23 | 0.31.24 |
@cubejs-backend/api-gateway npm | From 0.31.23 | 0.31.24 |
Products include Cube Cube.js.
How do I fix CVE-2022-23510?
Upgrade @cubejs-backend/api-gateway to 0.31.24 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-23510 being exploited?
There is no known exploitation of CVE-2022-23510 in the wild and no public exploit code.
Other vulnerabilities in cube-js cube.js
Sources
Also known as GHSA-6jqm-3c9g-pch7.