CVE-2021-32814
📋 TL;DR
CVE-2021-32814 is a directory traversal vulnerability in Skytable NoSQL database that allows remote attackers to delete or modify critical files on the host system. This affects all Skytable versions before 0.5.1. The vulnerability enables file system manipulation through path traversal techniques.
💻 Affected Systems
- Skytable
📦 What is this software?
Skytable by Skytable
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, configuration files, or database corruption leading to data loss and service disruption.
Likely Case
Database corruption, data loss, or service disruption through deletion of Skytable configuration and data files.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized connections to Skytable instances.
🎯 Exploit Status
The vulnerability requires network access to Skytable but no authentication. Exploitation involves directory traversal payloads in file operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.1
Vendor Advisory: https://security.skytable.io/ve/s/00001.html
Restart Required: Yes
Instructions:
1. Stop Skytable service. 2. Backup configuration and data. 3. Upgrade to Skytable 0.5.1 or later. 4. Restart Skytable service. 5. Verify functionality.
🔧 Temporary Workarounds
No workarounds available
allThe vendor states there are no known workarounds aside from upgrading to patched version.
🧯 If You Can't Patch
- Isolate Skytable instances behind firewalls with strict network access controls
- Implement network segmentation to limit exposure to trusted hosts only
🔍 How to Verify
Check if Vulnerable:
Check Skytable version: if version is less than 0.5.1, the system is vulnerable.Check Version:
skytable --versionVerify Fix Applied:
Verify Skytable version is 0.5.1 or higher after upgrade.📡 Detection & Monitoring
Log Indicators:
- Unusual file path patterns in Skytable logs
- Failed file operations with traversal patterns
- Unexpected file deletion events
Network Indicators:
- Directory traversal patterns in network traffic to Skytable port
- Unusual file operation requests from untrusted sources
SIEM Query:
source="skytable.log" AND ("..\" OR "../" OR "%2e%2e" OR path_traversal_patterns)🔗 References
- https://github.com/skytable/skytable/blob/next/CHANGELOG.md#version-051-2021-03-17
- https://github.com/skytable/skytable/commit/38b011273bb92b83c61053ae2fcd80aa9320315c#diff-1cdcf1a793c71ec658782437e4da7e3a37042bc1e2c12545942e9a14679c4b7e
- https://github.com/skytable/skytable/security/advisories/GHSA-2hj9-cxmc-m4g7
- https://security.skytable.io/ve/s/00001.html
- https://github.com/skytable/skytable/blob/next/CHANGELOG.md#version-051-2021-03-17
- https://github.com/skytable/skytable/commit/38b011273bb92b83c61053ae2fcd80aa9320315c#diff-1cdcf1a793c71ec658782437e4da7e3a37042bc1e2c12545942e9a14679c4b7e
- https://github.com/skytable/skytable/security/advisories/GHSA-2hj9-cxmc-m4g7
- https://security.skytable.io/ve/s/00001.html
