CVE-2023-30867 Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability
Authenticated users can exploit SQL injection in fuzzy search features to leak sensitive information from the database.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30867?
CVE-2023-30867 is a medium-severity SQL injection vulnerability in Apache StreamPark (incubating), published on 15 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters, leading to SQL injection. This could potentially result in information leakage.
Mitigation:
Users are recommended to upgrade to version 2.1.2, which fixes the issue.
Weakness: CWE-89
Which versions are affected by CVE-2023-30867?
2 open source packages ship an affected version, including org.apache.streampark:streampark. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.streampark:streampark Maven | From 2.0.0 | 2.1.2 |
org.apache.streampark:streampark Maven | From 2.0.0 | 2.1.2 |
Products include Apache Streampark.
How do I fix CVE-2023-30867?
Upgrade org.apache.streampark:streampark to 2.1.2 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-30867 being exploited?
There is no known exploitation of CVE-2023-30867 in the wild and no public exploit code.
Other vulnerabilities in Apache StreamPark (incubating)
- CVE-2022-45802 Apache StreamPark (incubating): Upload any file to any directory
- CVE-2024-29070 Apache StreamPark: session not invalidated after logout
- CVE-2022-46365 Apache StreamPark (incubating): Logic error causing any account reset
- CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability
- CVE-2023-52291 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
Sources
Also known as GHSA-rrcg-jwr5-32g7.