CVE-2021-41148
📋 TL;DR
This SQL injection vulnerability in Tuleap Open ALM allows attackers with dashboard editing permissions to execute arbitrary SQL queries. It affects Tuleap Community Edition before version 11.16.99.173 and Enterprise Edition before versions 11.16-6 and 11.15-8. The vulnerability stems from insufficient input validation in the CI widget functionality.
💻 Affected Systems
- Tuleap Open ALM Community Edition
- Tuleap Open ALM Enterprise Edition
📦 What is this software?
Tuleap by Enalean
Tuleap by Enalean
Tuleap by Enalean
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, privilege escalation, or remote code execution via database functions.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permission restrictions, potentially only affecting non-sensitive data.
🎯 Exploit Status
Exploitation requires authenticated user with dashboard editing permissions
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Community Edition 11.16.99.173, Enterprise Edition 11.16-6, Enterprise Edition 11.15-8
Vendor Advisory: https://github.com/Enalean/tuleap/security/advisories/GHSA-3c4q-8c35-cp63
Restart Required: Yes
Instructions:
1. Backup your Tuleap instance and database. 2. Update to patched version using your distribution's package manager. 3. Restart Tuleap services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict Dashboard Permissions
allTemporarily restrict ability to add CI widgets to trusted administrators only
Database Query Monitoring
allEnable detailed database query logging to detect SQL injection attempts
🧯 If You Can't Patch
- Implement strict input validation for all CI widget parameters
- Apply database-level restrictions to limit query execution capabilities
🔍 How to Verify
Check if Vulnerable:
Check Tuleap version via web interface or command lineCheck Version:
tuleap info | grep 'Tuleap version'Verify Fix Applied:
Verify version is equal to or greater than patched versions📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by dashboard modifications
Network Indicators:
- Unusual database connection patterns from Tuleap application server
SIEM Query:
source="tuleap_logs" AND ("SQL" OR "database error" OR "syntax error")🔗 References
- https://github.com/Enalean/tuleap/commit/91535add59f4b3a04b6b8eab123c002cd5af180d
- https://github.com/Enalean/tuleap/security/advisories/GHSA-3c4q-8c35-cp63
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=91535add59f4b3a04b6b8eab123c002cd5af180d
- https://tuleap.net/plugins/tracker/?aid=15028
- https://github.com/Enalean/tuleap/commit/91535add59f4b3a04b6b8eab123c002cd5af180d
- https://github.com/Enalean/tuleap/security/advisories/GHSA-3c4q-8c35-cp63
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=91535add59f4b3a04b6b8eab123c002cd5af180d
- https://tuleap.net/plugins/tracker/?aid=15028
