CVE-2023-42454
📋 TL;DR
This vulnerability in SQLpage allows attackers to retrieve database connection strings from publicly exposed instances, potentially gaining direct access to databases. It affects SQLpage versions before 0.11.1 when specific configuration conditions are met. Users with publicly exposed SQLpage instances storing database credentials in configuration files are at risk.
💻 Affected Systems
- SQLpage
📦 What is this software?
Sqlpage by Lovasoa
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including data theft, modification, or deletion, and potential lateral movement to other systems.
Likely Case
Database credential exposure leading to unauthorized data access and potential data exfiltration.
If Mitigated
No impact if database is not publicly exposed and credentials are stored securely.
🎯 Exploit Status
Exploitation requires specific configuration conditions but is straightforward when present.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.11.1
Vendor Advisory: https://github.com/lovasoa/SQLpage/security/advisories/GHSA-v5wf-jg37-r9m5
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update SQLpage to version 0.11.1 or later. 3. Restart SQLpage service. 4. Verify version with 'sqlpage --version'.
🔧 Temporary Workarounds
Use Environment Variable for Database Connection
allStore database connection string in environment variable instead of configuration file.
export DATABASE_URL="your_connection_string_here"
Remove database connection from sqlpage.json
Change Web Root Directory
allSet web_root to directory that is not parent of SQLpage configuration directory.
Edit sqlpage.json to set "web_root": "/path/to/safe/directory"
🧯 If You Can't Patch
- Move database connection string from sqlpage.json to environment variable
- Ensure database is not publicly exposed and restrict network access
🔍 How to Verify
Check if Vulnerable:
Check if SQLpage version < 0.11.1 AND database connection string is in sqlpage.json AND web_root is current directory.Check Version:
sqlpage --versionVerify Fix Applied:
Confirm version is 0.11.1+ with 'sqlpage --version' and verify database connection is not exposed in configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual database connection attempts
- Configuration file access patterns
Network Indicators:
- Unexpected database connections from web server IPs
- SQLpage configuration file requests
SIEM Query:
source="sqlpage.log" AND ("configuration" OR "database_connection")🔗 References
- https://github.com/lovasoa/SQLpage/issues/89
- https://github.com/lovasoa/SQLpage/releases/tag/v0.11.1
- https://github.com/lovasoa/SQLpage/security/advisories/GHSA-v5wf-jg37-r9m5
- https://github.com/lovasoa/SQLpage/issues/89
- https://github.com/lovasoa/SQLpage/releases/tag/v0.11.1
- https://github.com/lovasoa/SQLpage/security/advisories/GHSA-v5wf-jg37-r9m5
