~ / search / GHSA-v3hp-mcj5-pg39

GHSA-v3hp-mcj5-pg39

HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-0620

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/vault >= 0.8.0, < 1.11.9 1.11.9
Go github.com/hashicorp/vault >= 1.12.0, < 1.12.5 1.12.5
Go github.com/hashicorp/vault >= 1.13.0, < 1.13.1 1.13.1

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Vault and Vault Enterprise versions 0.8.0 until 1.13.1 are vulnerable to an SQL injection attack when using the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin, certain parameters are required to establish a connection (schema, database, and table) are not sanitized when passed to the user-provided MSSQL database. A privileged attacker with the ability to write arbitrary data to Vault's configuration may modify these parameters to execute a malicious SQL command when the Vault configuration is applied. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.

References

External links from the advisory. They lead to third-party sites.