Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/devtron-labs/devtron

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7GoPublished

    Devtron has SQL Injection in CreateUser API

    CVE-2024-45794 · GHSA-q78v-cv36-8fxj

    Affected
    • Go github.com/devtron-labs/devtron < 0.7.2
    Fixed in
    0.7.2· Vendor fix available
    Issue
    An authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). Details The API is CreateUser (/orchestrator/user). The function to read user input is: https://github.com/devtron-labs/devtron/blob/4296366ae288f3a67f87e547d2b946acbcd2dd65/api/auth/user/UserRestHandler.go#L96-L104 The userInfo (line 104) parameter can be controlled by users. The SQL injection can happen in the code: https://github.com/devtron-labs/devtron/blob/4296366ae288f3a67f87e547d2b946acbcd2dd65/pkg/auth/user/repository/UserAuthRepository.go#L1038 The query (line 1038) parameter can be controlled by a user to create and execute a malicious SQL query. The user should be authenticated but only needs minimum permissions: PoC Demonstrate a blind SQL injection to retrieve the database name: The debugging breakpoint indicated that the malicious SQL query was executed: We can see that we can get the…

    Recommended action: Upgrade to 0.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →