CVE-2024-35181
📋 TL;DR
A SQL injection vulnerability in Meshery versions prior to 0.7.22 allows attackers to execute arbitrary SQL commands via the 'order' query parameter in the GetMeshSyncResourcesKinds API endpoint. This can lead to arbitrary file writes, data theft, and modification of sensitive configuration data. All Meshery deployments running vulnerable versions are affected.
💻 Affected Systems
- Meshery
📦 What is this software?
Meshery by Layer5
⚠️ Risk & Real-World Impact
Worst Case
Attackers can write arbitrary files to the server, steal session cookies from performance profiles, access Kubernetes configurations, and potentially achieve remote code execution through file manipulation.
Likely Case
Attackers can extract sensitive data from the database including performance profiles, application data, and Kubernetes configurations, potentially leading to lateral movement within the infrastructure.
If Mitigated
With proper input validation and parameterized queries, the SQL injection would be prevented, limiting impact to normal API functionality.
🎯 Exploit Status
The vulnerability is in a publicly accessible API endpoint and SQL injection exploitation is well-understood with many available tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.7.22
Vendor Advisory: https://github.com/meshery/meshery/security/advisories
Restart Required: Yes
Instructions:
1. Stop Meshery service. 2. Update to version 0.7.22 or later using your deployment method (Docker, Kubernetes, etc.). 3. Restart Meshery service. 4. Verify the fix by checking the version and testing the vulnerable endpoint.
🔧 Temporary Workarounds
API Endpoint Restriction
allBlock or restrict access to the vulnerable API endpoint using network controls or web application firewall rules.
# Example nginx location block
location /api/system/meshsync/resources/kinds {
deny all;
return 403;
}
Input Validation Filter
allImplement input validation at the proxy/WAF level to reject SQL injection patterns in the 'order' parameter.
# Example ModSecurity rule
SecRule ARGS:order "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt'"
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to Meshery API endpoints to trusted sources only.
- Deploy a web application firewall (WAF) with SQL injection protection rules in front of Meshery.
🔍 How to Verify
Check if Vulnerable:
Check if Meshery version is below 0.7.22 and test the /api/system/meshsync/resources/kinds endpoint with SQL injection payloads in the 'order' parameter.Check Version:
mesheryctl version or check Meshery UI dashboard for version informationVerify Fix Applied:
After patching, verify version is 0.7.22 or higher and test that SQL injection payloads no longer execute successfully.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed attempts to /api/system/meshsync/resources/kinds
- ATTACH DATABASE commands in SQL logs
Network Indicators:
- SQL keywords in HTTP GET parameters
- Unusual patterns of requests to the vulnerable endpoint
- Stacked query patterns in HTTP traffic
SIEM Query:
source="meshery" AND (url="/api/system/meshsync/resources/kinds" AND (param="order" AND value MATCHES "(?i)(SELECT|UNION|ATTACH|--|;)"))🔗 References
- https://github.com/meshery/meshery/blob/b331f45c9083d7abf6b90105072b04cd22473de7/server/handlers/meshsync_handler.go#L187
- https://github.com/meshery/meshery/commit/8e995ce21af02d32ef61689c1e1748a745917f13
- https://github.com/meshery/meshery/commit/b55f6064d0c6a965aee38f30281f99da7dc4420c
- https://github.com/meshery/meshery/pull/10207
- https://github.com/meshery/meshery/pull/10280
- https://securitylab.github.com/advisories/GHSL-2024-013_GHSL-2024-014_Meshery/
- https://github.com/meshery/meshery/blob/b331f45c9083d7abf6b90105072b04cd22473de7/server/handlers/meshsync_handler.go#L187
- https://github.com/meshery/meshery/commit/8e995ce21af02d32ef61689c1e1748a745917f13
- https://github.com/meshery/meshery/commit/b55f6064d0c6a965aee38f30281f99da7dc4420c
- https://github.com/meshery/meshery/pull/10207
- https://github.com/meshery/meshery/pull/10280
- https://securitylab.github.com/advisories/GHSL-2024-013_GHSL-2024-014_Meshery/
