CVE-2021-43608
📋 TL;DR
CVE-2021-43608 is a SQL injection vulnerability in Doctrine DBAL where offset and length parameters in LIMIT clauses aren't properly cast to integers. This allows attackers to inject malicious SQL if applications pass unescaped user input to QueryBuilder or related APIs. Applications using Doctrine DBAL 3.x before 3.1.4 are affected.
💻 Affected Systems
- Doctrine Database Abstraction Layer (DBAL)
📦 What is this software?
Database Abstraction Layer by Doctrine Project
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including data theft, modification, or deletion, and potential remote code execution depending on database configuration.
Likely Case
Data exfiltration, unauthorized data modification, and potential privilege escalation through SQL injection.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited, and the vulnerability is in a widely used database abstraction library.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.4 or later
Vendor Advisory: https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622
Restart Required: No
Instructions:
1. Update Doctrine DBAL to version 3.1.4 or later using composer: 'composer require doctrine/dbal:^3.1.4' 2. Verify the update with 'composer show doctrine/dbal' 3. Test application functionality after update.
🔧 Temporary Workarounds
Input Validation Workaround
allManually validate and cast offset/limit parameters to integers before passing to DBAL
// PHP example: $limit = (int)$_GET['limit']; $offset = (int)$_GET['offset'];
🧯 If You Can't Patch
- Implement strict input validation for all user-provided limit/offset parameters
- Use parameterized queries and avoid passing raw user input to QueryBuilder limit methods
🔍 How to Verify
Check if Vulnerable:
Check composer.json or run 'composer show doctrine/dbal' to see if version is between 3.0.0 and 3.1.3Check Version:
composer show doctrine/dbal | grep versionsVerify Fix Applied:
Confirm version is 3.1.4 or higher with 'composer show doctrine/dbal'📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries with LIMIT clauses containing non-numeric values
- Database errors related to SQL syntax in LIMIT operations
Network Indicators:
- HTTP requests with suspicious limit/offset parameters containing SQL keywords
SIEM Query:
web_logs WHERE (uri_query CONTAINS 'limit=' OR uri_query CONTAINS 'offset=') AND (uri_query CONTAINS 'UNION' OR uri_query CONTAINS 'SELECT' OR uri_query CONTAINS '--')🔗 References
- https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d
- https://github.com/doctrine/dbal/releases
- https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622
- https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html
- https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d
- https://github.com/doctrine/dbal/releases
- https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622
- https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html
