CVE-2023-0620 Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend
Attackers can execute malicious SQL commands via unsanitized parameters in the MSSQL storage backend configuration, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-0620?
CVE-2023-0620 is a medium-severity SQL injection vulnerability in Hashicorp Vault, published on 30 Mar 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command.
This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.
Weakness: CWE-89
Which versions are affected by CVE-2023-0620?
8 open source packages ship an affected version, including github.com/hashicorp/vault and vault. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/vault Go | From 0.8.0 | 1.11.9, 1.12.5, 1.13.1 |
github.com/hashicorp/vault Go | From 0.8.0 | 1.11.9 |
github.com/hashicorp/vault Go | From 0.8.0 | 1.11.9 |
github.com/hashicorp/vault Go | From 1.12.0 | 1.12.5 |
github.com/hashicorp/vault Go | From 1.12.0 | 1.12.5 |
github.com/hashicorp/vault Go | From 1.13.0 | 1.13.1 |
2 more packages
github.com/hashicorp/vault Go | From 1.13.0 | 1.13.1 |
vault Bitnami | All versions | 1.11.9, 1.12.5, 1.13.1 |
Products include Hashicorp Vault.
How do I fix CVE-2023-0620?
Upgrade github.com/hashicorp/vault to a fixed version for your release line: 1.11.9, 1.12.5 or 1.13.1.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-0620 being exploited?
There is no known exploitation of CVE-2023-0620 in the wild and no public exploit code.
Other vulnerabilities in Hashicorp Vault
Sources
Also known as BIT-vault-2023-0620, GHSA-v3hp-mcj5-pg39, GO-2023-1685.