CVE-2024-45794 SQL Injection in CreateUser API in devtron
An authenticated user can execute malicious SQL queries via the CreateUser API in Devtron, potentially compromising data integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45794?
CVE-2024-45794 is a high-severity SQL injection vulnerability in devtron-labs devtron, published on 7 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-89
Which versions are affected by CVE-2024-45794?
3 open source packages ship an affected version, including github.com/devtron-labs/devtron. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/devtron-labs/devtron Go | All versions | 0.7.2 |
github.com/devtron-labs/devtron Go | All versions | 0.7.2 |
github.com/devtron-labs/devtron Go | All versions | 0.7.2 |
Products include Devtron Devtron.
How do I fix CVE-2024-45794?
Upgrade github.com/devtron-labs/devtron to 0.7.2 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-45794 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45794 exists.
Other vulnerabilities in devtron-labs devtron
Sources
Also known as GHSA-q78v-cv36-8fxj, GO-2024-3260.