GHSA-7fgc-3h6c-698r: Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path
Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Livewire PowerGridto a version that resolves this vulnerability.Fixed in 6.10.4
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Livewire PowerGrid from version 6.0.0 up to, but not including, 6.10.4 are affected when the naturalSort order-by path is used.
What access does an attacker need to exploit this issue?
An attacker needs low-privilege access and can send a crafted POST request to /livewire/update. No user interaction is required.
What should be done to remediate the issue?
Upgrade Livewire PowerGrid to version 6.10.4, which patches the issue.