Vulnerability Details : CVE-2023-28424
Soko if the code that powers packages.gentoo.org. Prior to version 1.0.2, the two package search handlers, `Search` and `SearchFeed`, implemented in `pkg/app/handler/packages/search.go`, are affected by a SQL injection via the `q` parameter. As a result, unauthenticated attackers can execute arbitrary SQL queries on `https://packages.gentoo.org/`. It was also demonstrated that primitive was enough to gain code execution in the context of the PostgreSQL container. The issue was addressed in commit `4fa6e4b619c0362728955b6ec56eab0e0cbf1e23y` of version 1.0.2 using prepared statements to interpolate user-controlled data in SQL queries.
Vulnerability category: Sql Injection
Products affected by CVE-2023-28424
- cpe:2.3:a:gentoo:soko:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-28424
0.49%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-28424
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
9.1
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
3.9
|
5.2
|
GitHub, Inc. |
CWE ids for CVE-2023-28424
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2023-28424
-
https://gitweb.gentoo.org/sites/soko.git/commit/?id=4fa6e4b619c0362728955b6ec56eab0e0cbf1e23
sites/soko.git - packages.gentoo.org (PROD)Patch
-
https://www.sonarsource.com/blog/why-orms-and-prepared-statements-cant-always-win
Why ORMs and Prepared Statements Can't (Always) Win | Sonar
-
https://github.com/gentoo/soko/security/advisories/GHSA-gc2x-86p3-mxg2
SQL Injection(s) in pkg/app/handler/packages/search.go · Advisory · gentoo/soko · GitHubVendor Advisory
Jump to