CVE-2023-30553: Multiple SQL injections in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-102
First published: Tue Apr 18 2023(Updated: )
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to multiple SQL injections in the `sql_api/api_workflow.py` endpoint `ExecuteCheck`. User input coming from the `db_name` parameter value and the `full_sql` parameter value in the `api_workflow.py` `ExecuteCheck` endpoint is passed to the methods that follow in given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. The affected methods are `execute_check` in `sql/engines/clickhouse.py` which concatenates input which is passed to execution on the database in the `sql/engines/clickhouse.py` `query` method, `execute_check` in `sql/engines/goinception.py`which concatenates input which is passed to execution on the database in the `sql/engines/goinception.py` `query` method, `execute_check` in `sql/engines/oracle.py`which passes unsafe user input into the `object_name_check` method in `sql/engines/oracle.py` which in turn is passed to execution on the database in the `sql/engines/oracle.py` `query` method. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as `GHSL-2022-102`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Archerydms Archery | =1.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-30553?
The severity of CVE-2023-30553 is medium with a CVSS score of 6.5.
What is CVE-2023-30553?
CVE-2023-30553 is a SQL injection vulnerability in the Archery open source SQL audit platform.
Which version of Archery is affected by CVE-2023-30553?
Archery version 1.9.0 is affected by CVE-2023-30553.
How can an attacker exploit CVE-2023-30553?
An attacker can exploit CVE-2023-30553 by using SQL injection techniques to query the connected databases through the 'ExecuteCheck' endpoint in 'sql_api/api_workflow.py'.
Is there a fix available for CVE-2023-30553?
Yes, the vulnerability has been fixed in Archery version 1.9.1 and later releases. It is recommended to upgrade to the latest version.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/references
- agent/last-modified-date
- agent/title
- agent/severity
- agent/first-publish-date
- agent/event
- agent/tags
- agent/description
- vendor/archerydms
- canonical/archerydms archery
- version/archerydms archery/1.9.0