cvelistv5 - cve-2022-24827

CVE-2022-24827 (GCVE-0-2022-24827)

Vulnerability from cvelistv5 – Published: 2022-04-11 20:13 – Updated: 2025-04-23 18:41

Summary

Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/yahoo/elide/security/advisorie…	x_refsource_CONFIRM
	https://github.com/yahoo/elide/pull/2581	x_refsource_MISC
	https://github.com/yahoo/elide/releases/tag/6.1.4	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	yahoo	elide	Affected: = 6.1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:50.529Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yahoo/elide/pull/2581"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yahoo/elide/releases/tag/6.1.4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24827",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:54:40.590453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T18:41:00.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "elide",
          "vendor": "yahoo",
          "versions": [
            {
              "status": "affected",
              "version": "= 6.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-11T20:13:29.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yahoo/elide/pull/2581"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yahoo/elide/releases/tag/6.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-8xpj-9j9g-fc9r",
        "discovery": "UNKNOWN"
      },
      "title": "SQL Injection in elide-datastore-aggregation",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24827",
          "STATE": "PUBLIC",
          "TITLE": "SQL Injection in elide-datastore-aggregation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "elide",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "= 6.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yahoo"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r",
              "refsource": "CONFIRM",
              "url": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r"
            },
            {
              "name": "https://github.com/yahoo/elide/pull/2581",
              "refsource": "MISC",
              "url": "https://github.com/yahoo/elide/pull/2581"
            },
            {
              "name": "https://github.com/yahoo/elide/releases/tag/6.1.4",
              "refsource": "MISC",
              "url": "https://github.com/yahoo/elide/releases/tag/6.1.4"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-8xpj-9j9g-fc9r",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24827",
    "datePublished": "2022-04-11T20:13:40.000Z",
    "dateReserved": "2022-02-10T00:00:00.000Z",
    "dateUpdated": "2025-04-23T18:41:00.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:elide:elide:6.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5969EC0D-4B5C-40A4-9E57-A5496661F57B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.\"}, {\"lang\": \"es\", \"value\": \"Elide es una biblioteca de Java que permite poner en marcha un servicio web GraphQL/JSON-API con un esfuerzo m\\u00ednimo. Cuando es aprovechado lo siguiente: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (Una columna que requiere un par\\u00e1metro proporcionado por el cliente), y una columna parametrizada de tipo TEXT. Se presenta la posibilidad de que un pirata inform\\u00e1tico proporcione una consulta cuidadosamente dise\\u00f1ada que omita los filtros de autorizaci\\u00f3n del lado del servidor mediante una inyecci\\u00f3n SQL. Un parche reciente de Elide versi\\u00f3n 6.1.2 permit\\u00eda incluir el car\\u00e1cter \\\"-\\\" en las columnas de tipo TEXTO parametrizadas. Este car\\u00e1cter puede interpretarse como comentarios SQL (\\\"--\\\") y permitir al atacante eliminar la cl\\u00e1usula WHERE de la consulta generada y omitir los filtros de autorizaci\\u00f3n. En Elide versi\\u00f3n 6.1.4 es proporcionada una correcci\\u00f3n. La vulnerabilidad s\\u00f3lo se presenta para columnas parametrizadas de tipo TEXT y s\\u00f3lo para consultas anal\\u00edticas (el CRUD no est\\u00e1 afectado). Las mitigaciones incluyen el aprovechamiento de un tipo diferente de columna parametrizada (TIEMPO, DINERO, etc.) o no aprovechar las columnas parametrizadas\"}]",
      "id": "CVE-2022-24827",
      "lastModified": "2024-11-21T06:51:11.173",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2022-04-11T21:15:08.470",
      "references": "[{\"url\": \"https://github.com/yahoo/elide/pull/2581\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/yahoo/elide/releases/tag/6.1.4\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/yahoo/elide/pull/2581\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/yahoo/elide/releases/tag/6.1.4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-89\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-24827\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-04-11T21:15:08.470\",\"lastModified\":\"2024-11-21T06:51:11.173\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.\"},{\"lang\":\"es\",\"value\":\"Elide es una biblioteca de Java que permite poner en marcha un servicio web GraphQL/JSON-API con un esfuerzo m\u00ednimo. Cuando es aprovechado lo siguiente: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (Una columna que requiere un par\u00e1metro proporcionado por el cliente), y una columna parametrizada de tipo TEXT. Se presenta la posibilidad de que un pirata inform\u00e1tico proporcione una consulta cuidadosamente dise\u00f1ada que omita los filtros de autorizaci\u00f3n del lado del servidor mediante una inyecci\u00f3n SQL. Un parche reciente de Elide versi\u00f3n 6.1.2 permit\u00eda incluir el car\u00e1cter \\\"-\\\" en las columnas de tipo TEXTO parametrizadas. Este car\u00e1cter puede interpretarse como comentarios SQL (\\\"--\\\") y permitir al atacante eliminar la cl\u00e1usula WHERE de la consulta generada y omitir los filtros de autorizaci\u00f3n. En Elide versi\u00f3n 6.1.4 es proporcionada una correcci\u00f3n. La vulnerabilidad s\u00f3lo se presenta para columnas parametrizadas de tipo TEXT y s\u00f3lo para consultas anal\u00edticas (el CRUD no est\u00e1 afectado). Las mitigaciones incluyen el aprovechamiento de un tipo diferente de columna parametrizada (TIEMPO, DINERO, etc.) o no aprovechar las columnas parametrizadas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:elide:elide:6.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5969EC0D-4B5C-40A4-9E57-A5496661F57B\"}]}]}],\"references\":[{\"url\":\"https://github.com/yahoo/elide/pull/2581\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/yahoo/elide/releases/tag/6.1.4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/yahoo/elide/pull/2581\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/yahoo/elide/releases/tag/6.1.4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/yahoo/elide/pull/2581\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/yahoo/elide/releases/tag/6.1.4\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T04:20:50.529Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-24827\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T15:54:40.590453Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T15:54:42.515Z\"}}], \"cna\": {\"title\": \"SQL Injection in elide-datastore-aggregation\", \"source\": {\"advisory\": \"GHSA-8xpj-9j9g-fc9r\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"yahoo\", \"product\": \"elide\", \"versions\": [{\"status\": \"affected\", \"version\": \"= 6.1.3\"}]}], \"references\": [{\"url\": \"https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/yahoo/elide/pull/2581\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/yahoo/elide/releases/tag/6.1.4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-04-11T20:13:29.000Z\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, \"source\": {\"advisory\": \"GHSA-8xpj-9j9g-fc9r\", \"discovery\": \"UNKNOWN\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"= 6.1.3\"}]}, \"product_name\": \"elide\"}]}, \"vendor_name\": \"yahoo\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r\", \"name\": \"https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://github.com/yahoo/elide/pull/2581\", \"name\": \"https://github.com/yahoo/elide/pull/2581\", \"refsource\": \"MISC\"}, {\"url\": \"https://github.com/yahoo/elide/releases/tag/6.1.4\", \"name\": \"https://github.com/yahoo/elide/releases/tag/6.1.4\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2022-24827\", \"STATE\": \"PUBLIC\", \"TITLE\": \"SQL Injection in elide-datastore-aggregation\", \"ASSIGNER\": \"security-advisories@github.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-24827\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-23T18:41:00.995Z\", \"dateReserved\": \"2022-02-10T00:00:00.000Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2022-04-11T20:13:40.000Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CNVD-2022-85102

Vulnerability from cnvd - Published: 2022-12-06

Title

Elide SQL注入漏洞

Description

Elide是一个Java库。 Elide存在SQL注入漏洞，攻击者可利用该漏洞执行任意SQL语句。

Severity

中

Patch Name

Elide SQL注入漏洞的补丁

Patch Description

Elide是一个Java库。 Elide存在SQL注入漏洞，攻击者可利用该漏洞执行任意SQL语句。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r

Reference

https://nvd.nist.gov/vuln/detail/CVE-2022-24827

Impacted products

Name
Elide Elide 6.1.2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-24827",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-24827"
    }
  },
  "description": "Elide\u662f\u4e00\u4e2aJava\u5e93\u3002\n\nElide\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610fSQL\u8bed\u53e5\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-85102",
  "openTime": "2022-12-06",
  "patchDescription": "Elide\u662f\u4e00\u4e2aJava\u5e93\u3002\r\n\r\nElide\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610fSQL\u8bed\u53e5\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Elide SQL\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Elide Elide 6.1.2"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-24827",
  "serverity": "\u4e2d",
  "submitTime": "2022-04-12",
  "title": "Elide SQL\u6ce8\u5165\u6f0f\u6d1e"
}

GHSA-8XPJ-9J9G-FC9R

Vulnerability from github – Published: 2022-04-08 22:43 – Updated: 2022-04-18 22:19

Summary

SQL Injection in elide-datastore-aggregation

Details

Impact

When leveraging the following together:

Elide Aggregation Data Store for Analytic Queries
Parameterized Columns (A column that requires a client provided parameter)
A parameterized column of type TEXT

There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters.

Patches

A fix is provided in Elide 6.1.4.

Workarounds

The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.

For more information

If you have any questions or comments about this advisory: * Open an issue in elide * Contact us in Discord

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.yahoo.elide:elide-datastore-aggregation"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.3"
            },
            {
              "fixed": "6.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.1.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-08T22:43:17Z",
    "nvd_published_at": "2022-04-11T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nWhen leveraging the following together:\n\n- Elide Aggregation Data Store for Analytic Queries\n- Parameterized Columns (A column that requires a client provided parameter)\n- A parameterized column of type TEXT\n\nThere is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection.  A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns.  This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters.\n\n### Patches\nA [fix](https://github.com/yahoo/elide/pull/2581) is provided in [Elide 6.1.4](https://github.com/yahoo/elide/releases/tag/6.1.4).\n\n### Workarounds\nThe vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted).   Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [elide](https://github.com/yahoo/elide)\n* Contact us in [Discord](https://discord.com/invite/3vh8ac57cc)\n",
  "id": "GHSA-8xpj-9j9g-fc9r",
  "modified": "2022-04-18T22:19:44Z",
  "published": "2022-04-08T22:43:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24827"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yahoo/elide/pull/2581"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yahoo/elide"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yahoo/elide/releases/tag/6.1.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SQL Injection in elide-datastore-aggregation"
}

GSD-2022-24827

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-24827

Aliases

CVE-2022-24827

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-24827",
    "description": "Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.",
    "id": "GSD-2022-24827"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-24827"
      ],
      "details": "Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.",
      "id": "GSD-2022-24827",
      "modified": "2023-12-13T01:19:42.657633Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-24827",
        "STATE": "PUBLIC",
        "TITLE": "SQL Injection in elide-datastore-aggregation"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "elide",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "= 6.1.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "yahoo"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r",
            "refsource": "CONFIRM",
            "url": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r"
          },
          {
            "name": "https://github.com/yahoo/elide/pull/2581",
            "refsource": "MISC",
            "url": "https://github.com/yahoo/elide/pull/2581"
          },
          {
            "name": "https://github.com/yahoo/elide/releases/tag/6.1.4",
            "refsource": "MISC",
            "url": "https://github.com/yahoo/elide/releases/tag/6.1.4"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-8xpj-9j9g-fc9r",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[6.1.3]",
          "affected_versions": "Version 6.1.3",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-89",
            "CWE-937"
          ],
          "date": "2022-04-19",
          "description": "Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.",
          "fixed_versions": [
            "6.1.4"
          ],
          "identifier": "CVE-2022-24827",
          "identifiers": [
            "CVE-2022-24827",
            "GHSA-8xpj-9j9g-fc9r"
          ],
          "not_impacted": "All versions before 6.1.3, all versions after 6.1.3",
          "package_slug": "maven/com.yahoo.elide/elide-core",
          "pubdate": "2022-04-11",
          "solution": "Upgrade to version 6.1.4 or above.",
          "title": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-24827",
            "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r",
            "https://github.com/yahoo/elide/pull/2581",
            "https://github.com/yahoo/elide/releases/tag/6.1.4"
          ],
          "uuid": "0e1a722b-23a7-4ded-8b4d-bd7ca04ebf4b"
        },
        {
          "affected_range": "[6.1.3]",
          "affected_versions": "Version 6.1.3",
          "cwe_ids": [
            "CWE-1035",
            "CWE-89",
            "CWE-937"
          ],
          "date": "2022-04-12",
          "description": "Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.",
          "fixed_versions": [
            "6.1.4"
          ],
          "identifier": "CVE-2022-24827",
          "identifiers": [
            "GHSA-8xpj-9j9g-fc9r",
            "CVE-2022-24827"
          ],
          "not_impacted": "All versions before 6.1.3, all versions after 6.1.3",
          "package_slug": "maven/com.yahoo.elide/elide-datastore-aggregation",
          "pubdate": "2022-04-08",
          "solution": "Upgrade to version 6.1.4 or above.",
          "title": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
          "urls": [
            "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r",
            "https://github.com/yahoo/elide/pull/2581",
            "https://github.com/yahoo/elide/releases/tag/6.1.4",
            "https://github.com/advisories/GHSA-8xpj-9j9g-fc9r"
          ],
          "uuid": "4c0ba923-b290-4438-baa9-7210d239b8f7"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:elide:elide:6.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24827"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-89"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r"
            },
            {
              "name": "https://github.com/yahoo/elide/pull/2581",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/yahoo/elide/pull/2581"
            },
            {
              "name": "https://github.com/yahoo/elide/releases/tag/6.1.4",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/yahoo/elide/releases/tag/6.1.4"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-04-19T15:20Z",
      "publishedDate": "2022-04-11T21:15Z"
    }
  }
}

FKIE_CVE-2022-24827

Vulnerability from fkie_nvd - Published: 2022-04-11 21:15 - Updated: 2024-11-21 06:51

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/yahoo/elide/pull/2581	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/yahoo/elide/releases/tag/6.1.4	Release Notes, Third Party Advisory
security-advisories@github.com	https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/yahoo/elide/pull/2581	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/yahoo/elide/releases/tag/6.1.4	Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r	Third Party Advisory

Impacted products

	Vendor	Product	Version
	elide	elide	6.1.3

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elide:elide:6.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "5969EC0D-4B5C-40A4-9E57-A5496661F57B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the \u0027-\u0027 character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments (\u0027--\u0027) and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns."
    },
    {
      "lang": "es",
      "value": "Elide es una biblioteca de Java que permite poner en marcha un servicio web GraphQL/JSON-API con un esfuerzo m\u00ednimo. Cuando es aprovechado lo siguiente: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (Una columna que requiere un par\u00e1metro proporcionado por el cliente), y una columna parametrizada de tipo TEXT. Se presenta la posibilidad de que un pirata inform\u00e1tico proporcione una consulta cuidadosamente dise\u00f1ada que omita los filtros de autorizaci\u00f3n del lado del servidor mediante una inyecci\u00f3n SQL. Un parche reciente de Elide versi\u00f3n 6.1.2 permit\u00eda incluir el car\u00e1cter \"-\" en las columnas de tipo TEXTO parametrizadas. Este car\u00e1cter puede interpretarse como comentarios SQL (\"--\") y permitir al atacante eliminar la cl\u00e1usula WHERE de la consulta generada y omitir los filtros de autorizaci\u00f3n. En Elide versi\u00f3n 6.1.4 es proporcionada una correcci\u00f3n. La vulnerabilidad s\u00f3lo se presenta para columnas parametrizadas de tipo TEXT y s\u00f3lo para consultas anal\u00edticas (el CRUD no est\u00e1 afectado). Las mitigaciones incluyen el aprovechamiento de un tipo diferente de columna parametrizada (TIEMPO, DINERO, etc.) o no aprovechar las columnas parametrizadas"
    }
  ],
  "id": "CVE-2022-24827",
  "lastModified": "2024-11-21T06:51:11.173",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-04-11T21:15:08.470",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/yahoo/elide/pull/2581"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/yahoo/elide/releases/tag/6.1.4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/yahoo/elide/pull/2581"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/yahoo/elide/releases/tag/6.1.4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/yahoo/elide/security/advisories/GHSA-8xpj-9j9g-fc9r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-24827 (GCVE-0-2022-24827)

CNVD-2022-85102

GHSA-8XPJ-9J9G-FC9R

Impact

Patches

Workarounds

For more information

GSD-2022-24827

FKIE_CVE-2022-24827

Tags

Sightings

Nomenclature