CVE-2023-0953
📋 TL;DR
This SQL injection vulnerability in Devolutions Server allows authenticated attackers to execute arbitrary SQL commands through insufficient input sanitization in the documentation feature. Attackers could potentially access, modify, or delete sensitive data in the database. Organizations running Devolutions Server 2022.3.12 or earlier are affected.
💻 Affected Systems
- Devolutions Server
📦 What is this software?
Devolutions Server by Devolutions
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, and potential remote code execution on the underlying server.
Likely Case
Unauthorized access to sensitive credential data stored in the Devolutions Server database, potentially enabling lateral movement within the network.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit once discovered, but this requires authenticated access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2022.3.13 or later
Vendor Advisory: https://devolutions.net/security/advisories/DEVO-2023-0003
Restart Required: Yes
Instructions:
1. Backup your Devolutions Server database and configuration. 2. Download and install Devolutions Server 2022.3.13 or later from the official website. 3. Follow the upgrade instructions in the vendor documentation. 4. Restart the Devolutions Server service.
🔧 Temporary Workarounds
Disable documentation feature
allTemporarily disable the vulnerable documentation feature until patching is possible.
Implement WAF rules
allDeploy web application firewall rules to block SQL injection patterns targeting the documentation endpoint.
🧯 If You Can't Patch
- Restrict access to Devolutions Server to only trusted users and networks
- Implement database-level controls to limit SQL user permissions to minimum required
🔍 How to Verify
Check if Vulnerable:
Check Devolutions Server version in administration console or via version file in installation directory.Check Version:
Check web interface or examine version.txt in installation directoryVerify Fix Applied:
Verify version is 2022.3.13 or later and test documentation feature with SQL injection test payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed authentication attempts followed by documentation feature access
- Unusual patterns in Devolutions Server application logs
Network Indicators:
- SQL injection patterns in HTTP requests to documentation endpoints
- Unusual database connections from Devolutions Server host
SIEM Query:
source="devolutions.log" AND ("documentation" AND ("' OR", "UNION", "SELECT", "INSERT", "DELETE"))