CVE-2022-23510

cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade to 0.31.24 or to downgrade to 0.31.22. There are no known workarounds for this vulnerability.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cube-js/cube.js/commit/3c614674fed6ca17df08bbba8c835ef110167570	Patch Third Party Advisory
https://github.com/cube-js/cube.js/commit/f1140de508e359970ac82b50bae1c4bf152f6041	Patch Third Party Advisory
https://github.com/cube-js/cube.js/security/advisories/GHSA-6jqm-3c9g-pch7	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cube:cube.js:0.31.23:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2022-12-09 23:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-23510

Mitre link : CVE-2022-23510

CVE.ORG link : CVE-2022-23510

JSON object : View

Products Affected

cube

cube.js

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2022-23510", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.1}]}, "published": "2022-12-09T23:15:22.227", "references": [{"url": "https://github.com/cube-js/cube.js/commit/3c614674fed6ca17df08bbba8c835ef110167570", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cube-js/cube.js/commit/f1140de508e359970ac82b50bae1c4bf152f6041", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cube-js/cube.js/security/advisories/GHSA-6jqm-3c9g-pch7", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade to 0.31.24 or to downgrade to 0.31.22. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "cube-js es una plataforma de inteligencia empresarial headless. En la versi\u00f3n 0.31.23, todos los clientes Cube autenticados pod\u00edan eludir la seguridad de nivel de fila de SQL y ejecutar SQL arbitrario a trav\u00e9s del endpoint /v1/sql-runner recientemente introducido. Este problema se resolvi\u00f3 en la versi\u00f3n 0.31.24. Se recomienda a los usuarios actualizar a 0.31.24 o bajar a 0.31.22. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2022-12-13T15:07:13.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cube:cube.js:0.31.23:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "DE64AB39-926F-4408-807E-86F1E6C917FC"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}