CVE-2023-47128

Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a `savepoints` `name` parameter to a user is highly unlikely, it would not be unheard of. If a malicious user was able to abuse this functionality they would have essentially direct access to the database and the ability to modify data to the level of permissions associated with the database user. A non exhaustive list of actions possible based on database permissions is: Read all data stored in the database, including usernames and password hashes; insert arbitrary data into the database, including modifying existing records; and gain a shell on the underlying server. Version 1.1.1 fixes this issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/piccolo-orm/piccolo/commit/82679eb8cd1449cf31d87c9914a072e70168b6eb	Patch
https://github.com/piccolo-orm/piccolo/security/advisories/GHSA-xq59-7jf3-rjc6	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:piccolo-orm:piccolo:1.1.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-11-10 18:15

Updated : 2023-11-20 19:35

NVD link : CVE-2023-47128

Mitre link : CVE-2023-47128

CVE.ORG link : CVE-2023-47128

JSON object : View

Products Affected

piccolo-orm

piccolo

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2023-47128", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2023-11-10T18:15:09.870", "references": [{"url": "https://github.com/piccolo-orm/piccolo/commit/82679eb8cd1449cf31d87c9914a072e70168b6eb", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/piccolo-orm/piccolo/security/advisories/GHSA-xq59-7jf3-rjc6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a `savepoints` `name` parameter to a user is highly unlikely, it would not be unheard of. If a malicious user was able to abuse this functionality they would have essentially direct access to the database and the ability to modify data to the level of permissions associated with the database user. A non exhaustive list of actions possible based on database permissions is: Read all data stored in the database, including usernames and password hashes; insert arbitrary data into the database, including modifying existing records; and gain a shell on the underlying server. Version 1.1.1 fixes this issue."}, {"lang": "es", "value": "Piccolo es un generador de consultas y mapeo relacional de objetos que admite asyncio. Antes de la versi\u00f3n 1.1.1, el manejo de \"savepoints\" de transacciones con nombre en todas las implementaciones de bases de datos es vulnerable a la inyecci\u00f3n SQL a trav\u00e9s de cadenas f. Si bien la probabilidad de que un desarrollador final exponga un par\u00e1metro de \"name\" de \"savepoints\" a un usuario es muy poco probable, no ser\u00eda algo inaudito. Si un usuario malintencionado pudiera abusar de esta funcionalidad, tendr\u00eda esencialmente acceso directo a la base de datos y la capacidad de modificar los datos al nivel de permisos asociados con el usuario de la base de datos. Una lista no exhaustiva de acciones posibles seg\u00fan los permisos de la base de datos es: Leer todos los datos almacenados en la base de datos, incluidos los nombres de usuario y los hashes de contrase\u00f1as; insertar datos arbitrarios en la base de datos, incluida la modificaci\u00f3n de registros existentes; y obtener un shell en el servidor subyacente. La versi\u00f3n 1.1.1 soluciona este problema."}], "lastModified": "2023-11-20T19:35:23.087", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:piccolo-orm:piccolo:1.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "355EE2C8-1D3F-458B-8A51-4A6904485DD1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}