CVE-2022-36084 cruddl vulnerable to AQL injection through flexSearch
Attackers with read permissions can inject arbitrary AQL queries into ArangoDB via cruddl's flexSearch feature, potentially executing code or reading data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36084?
CVE-2022-36084 is a critical code injection vulnerability in AEB-labs cruddl, published on 8 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas.
Which versions are affected by CVE-2022-36084?
4 open source packages ship an affected version, including cruddl. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cruddl npm | From 1.1.0 | 2.7.0 |
cruddl npm | From 1.1.0 | 2.7.0 |
cruddl npm | From 3.0.0 | 3.0.2 |
cruddl npm | From 3.0.0 | 3.0.2 |
Products include Aeb Cruddl.
How do I fix CVE-2022-36084?
Upgrade cruddl to a fixed version for your release line: 2.7.0 or 3.0.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-36084 being exploited?
There is no known exploitation of CVE-2022-36084 in the wild and no public exploit code.
Sources
Also known as GHSA-qm4w-4995-vg7f.