CVE-2024-12744
📋 TL;DR
This SQL injection vulnerability in Amazon Redshift JDBC Driver version 2.1.0.31 allows attackers to execute arbitrary SQL commands through the getSchemas, getTables, or getColumns Metadata APIs. This can lead to privilege escalation and unauthorized database access. Organizations using the vulnerable driver version in their Redshift applications are affected.
💻 Affected Systems
- Amazon Redshift JDBC Driver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including data exfiltration, privilege escalation to admin, and potential lateral movement to other systems.
Likely Case
Unauthorized data access, privilege escalation within the database, and potential data manipulation.
If Mitigated
Limited impact due to network segmentation, least privilege database accounts, and proper input validation in application layer.
🎯 Exploit Status
Exploitation requires the ability to call the vulnerable Metadata APIs, which typically requires some level of application access. SQL injection is a well-understood attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.0.32
Vendor Advisory: https://aws.amazon.com/security/security-bulletins/AWS-2024-015/
Restart Required: Yes
Instructions:
1. Identify all applications using Amazon Redshift JDBC Driver. 2. Check driver version in each application. 3. Update to version 2.1.0.32 from Maven Central or AWS download page. 4. Rebuild and redeploy applications. 5. Restart applications to load new driver.
🔧 Temporary Workarounds
Revert to previous version
allDowngrade to version 2.1.0.30 which is not vulnerable
Update pom.xml dependency: <version>2.1.0.30</version>
Update build.gradle: implementation 'com.amazon.redshift:redshift-jdbc42:2.1.0.30'
Application-level input validation
allImplement strict input validation and parameterized queries in application code
🧯 If You Can't Patch
- Implement network segmentation to restrict database access to trusted applications only
- Use database accounts with minimal required privileges and audit all database access
🔍 How to Verify
Check if Vulnerable:
Check the JDBC driver version in your application dependencies or classpath. For Maven: mvn dependency:tree | grep redshift-jdbc. For Gradle: gradle dependencies | grep redshift-jdbc.Check Version:
java -cp redshift-jdbc42-*.jar com.amazon.redshift.Driver --versionVerify Fix Applied:
Verify the driver version is 2.1.0.32 or 2.1.0.30 after update. Test the getSchemas, getTables, and getColumns APIs with SQL injection payloads to confirm they're rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries from application users
- Multiple failed login attempts followed by successful privileged access
- Unexpected schema or table enumeration
Network Indicators:
- Unusual database query patterns from application servers
- SQL syntax errors in database logs indicating injection attempts
SIEM Query:
source="redshift-logs" AND ("getSchemas" OR "getTables" OR "getColumns") AND (sql="*' OR '1'='1*" OR sql="*;--*" OR sql="*UNION*SELECT*")