CVE-2023-41891: FlyteAdmin SQL Injection in List Filters
Impact List endpoints on Flyte Admin has a SQL vulnerability where a malicious user can send a REST requests with custom SQL statements as list filters.
Workarounds The attacker needs to have access to the flyteadmin installation (typically either behind a VPN or authentication).
References https://owasp.org/www-community/attacks/SQLInjection#
Other sources
FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-41891?
The severity of CVE-2023-41891 is low (3.5).
What is the impact of CVE-2023-41891?
CVE-2023-41891 allows a malicious user to send REST requests with custom SQL statements as list filters, potentially exploiting a SQL vulnerability.
How can I mitigate the vulnerability in CVE-2023-41891?
To mitigate CVE-2023-41891, ensure that access to the flyteadmin installation is restricted, typically through a VPN or authentication.
Which software versions are affected by CVE-2023-41891?
CVE-2023-41891 affects the flyteadmin package version 1.1.124 exclusively.
Where can I find more information about CVE-2023-41891?
More information about CVE-2023-41891 can be found at the following references: [1](https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4) [2](https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fd) [3](https://github.com/advisories/GHSA-r847-6w6h-r8g4)