CVE-2022-21234
📋 TL;DR
This SQL injection vulnerability in Lansweeper's EchoAssets.aspx allows authenticated attackers to execute arbitrary SQL commands on the database. It affects Lansweeper 9.1.20.2 installations, potentially compromising sensitive asset data and system integrity.
💻 Affected Systems
- Lansweeper
📦 What is this software?
Lansweeper by Lansweeper
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential remote code execution on the underlying server.
Likely Case
Unauthorized access to sensitive asset information, configuration data, and potential lateral movement within the network.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized. Requires authenticated access but exploitation is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.1.20.3 or later
Vendor Advisory: https://www.lansweeper.com/changelog/
Restart Required: Yes
Instructions:
1. Download latest Lansweeper version from vendor website. 2. Backup current installation and database. 3. Run installer to upgrade to patched version. 4. Restart Lansweeper services.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or input validation to block SQL injection patterns
Access Restriction
windowsRestrict access to EchoAssets.aspx endpoint to only necessary users
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Lansweeper server
- Enforce principle of least privilege for database accounts used by Lansweeper
🔍 How to Verify
Check if Vulnerable:
Check Lansweeper version in web interface or installation directory. Version 9.1.20.2 is vulnerable.Check Version:
Check Help > About in Lansweeper web interface or examine Lansweeper installation filesVerify Fix Applied:
Verify version is 9.1.20.3 or later. Test EchoAssets.aspx endpoint with SQL injection test payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed authentication attempts followed by successful login
- Access to EchoAssets.aspx with suspicious parameters
Network Indicators:
- HTTP POST requests to EchoAssets.aspx containing SQL keywords
- Unusual database connection patterns from Lansweeper server
SIEM Query:
source="web_logs" AND uri="/EchoAssets.aspx" AND (param CONTAINS "UNION" OR param CONTAINS "SELECT" OR param CONTAINS "INSERT")