CVE-2023-37472: Query injection in Knowage server
Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior sanitization. An attacker can create specially crafted HQL queries that will break subsequent SQL queries generated by the Hibernate engine. The endpoint /knowage/restful-services/2.0/documents/listDocument calls the countBIObjects method of the BIObjectDAOHibImpl object with the user supplied label parameter without prior sanitization. This can lead to SQL injection in the backing database. Other injections have been identified in the application as well. An authenticated attacker with low privileges could leverage this vulnerability in order to retrieve sensitive information from the database, such as account credentials or business information. This issue has been addressed in version 8.1.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Knowageto a version that resolves this vulnerability.Fixed in 8.1.8
Event History
Frequently Asked Questions
What is CVE-2023-37472?
CVE-2023-37472 is a vulnerability in the Knowage open source suite for business analytics, where user-supplied data is used to create HQL queries without sanitization, allowing an attacker to create malicious queries that can break subsequent SQL queries.
What is the severity of CVE-2023-37472?
CVE-2023-37472 has a severity rating of 6.5 (high).
How does CVE-2023-37472 affect Knowage?
CVE-2023-37472 affects Knowage versions 6.1.0 to 8.1.8, allowing attackers to exploit the vulnerability by crafting malicious HQL queries.
How can an attacker exploit CVE-2023-37472?
An attacker can exploit CVE-2023-37472 by creating specially crafted HQL queries that break subsequent SQL queries generated by the Hibernate engine in Knowage.
Is there a fix for CVE-2023-37472?
Yes, it is recommended to update to a version of Knowage that includes the fix for CVE-2023-37472 to mitigate the vulnerability.