CVE-2024-12746
📋 TL;DR
This SQL injection vulnerability in the Amazon Redshift ODBC Driver allows attackers to execute arbitrary SQL commands through the SQLTables or SQLColumns Metadata APIs, potentially leading to privilege escalation. It affects users of the Amazon Redshift ODBC Driver version 2.1.5.0 on both Windows and Linux systems.
💻 Affected Systems
- Amazon Redshift ODBC Driver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including data exfiltration, privilege escalation to administrative access, and potential lateral movement to other systems.
Likely Case
Unauthorized data access, privilege escalation within the Redshift database, and potential data manipulation.
If Mitigated
Limited impact with proper network segmentation, least privilege access controls, and monitoring in place.
🎯 Exploit Status
Requires authenticated access to the ODBC driver, but SQL injection vulnerabilities are typically easy to exploit once discovered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.6.0
Vendor Advisory: https://aws.amazon.com/security/security-bulletins/AWS-2024-015/
Restart Required: Yes
Instructions:
1. Download version 2.1.6.0 from the official AWS repository. 2. Uninstall the current ODBC driver. 3. Install the new version. 4. Restart any applications using the driver.
🔧 Temporary Workarounds
Revert to previous version
allDowngrade to version 2.1.4.0 which is not affected by this vulnerability
Download and install version 2.1.4.0 from AWS repository
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in applications using the ODBC driver
- Apply network segmentation to limit access to systems using the vulnerable driver
🔍 How to Verify
Check if Vulnerable:
Check the ODBC driver version in system settings or using odbcinst -q -d on LinuxCheck Version:
odbcinst -q -d (Linux) or check ODBC Data Source Administrator (Windows)Verify Fix Applied:
Verify the driver version shows 2.1.6.0 or 2.1.4.0 after update/downgrade📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries through ODBC driver
- Multiple failed authentication attempts followed by successful connection
- Unexpected privilege escalation events
Network Indicators:
- Unusual database query patterns from ODBC connections
- Multiple metadata API calls in short timeframes
SIEM Query:
source="redshift_odbc" AND (query="SQLTables" OR query="SQLColumns") AND query CONTAINS suspicious_patterns