{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dbt-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.6.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dbt-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.7.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-40637"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-89",
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-17T15:52:57Z",
    "nvd_published_at": "2024-07-16T23:15:24Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nWhen a user installs a [package](https://docs.getdbt.com/docs/build/packages) in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt\u0027s functionality. However, this also means that a malicious package could potentially override these components with harmful code.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nFixed on 1.8.0, and patched for 1.6.14 and 1.7.14 releases.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nPreviously, a materialization defined in a package that shared a name with one of the built-in materializations would be preferred by default, without user action which is surprising and makes it more difficult to detect the insecure behaviour. We\u0027ve changed the default behaviour to require explicit overrides by users in `1.8.0`, and provided the ability to opt-out of built-in materialization overrides in 1.6 and 1.7 via the `flags.require_explicit_package_overrides_for_builtin_materializations: False` configuration in `dbt_project.yml`\n\nVersions older than 1.6 are EOL.\n\n### References\n_Are there any links users can visit to find out more?_\n* dbt documentation: https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags\n* https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies\n* https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability/\n* https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls/",
  "id": "GHSA-p3f3-5ccg-83xq",
  "modified": "2024-07-19T19:38:51Z",
  "published": "2024-07-17T15:52:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40637"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624"
    },
    {
      "type": "WEB",
      "url": "https://docs.getdbt.com/docs/build/packages"
    },
    {
      "type": "WEB",
      "url": "https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dbt-labs/dbt-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/dbt-core/PYSEC-2024-66.yaml"
    },
    {
      "type": "WEB",
      "url": "https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls"
    },
    {
      "type": "WEB",
      "url": "https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies"
    },
    {
      "type": "WEB",
      "url": "https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "dbt has an implicit override for built-in materializations from installed packages"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T14:33:07.870141Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-17T14:33:16.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:33:11.690Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq"
          },
          {
            "name": "https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6"
          },
          {
            "name": "https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624"
          },
          {
            "name": "https://docs.getdbt.com/docs/build/packages",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.getdbt.com/docs/build/packages"
          },
          {
            "name": "https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags"
          },
          {
            "name": "https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls"
          },
          {
            "name": "https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies"
          },
          {
            "name": "https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dbt-core",
          "vendor": "dbt-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.7.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt\u0027s functionality. However, this also means that a malicious package could potentially override these components with harmful code. This issue has been fixed in versions 1.8.0, 1.6.14 and 1.7.14. Users are advised to upgrade. There are no kn own workarounds for this vulnerability. Users updating to either 1.6.14 or 1.7.14 will need to set `flags.require_explicit_package_overrides_for_builtin_materializations: False` in their configuration in `dbt_project.yml`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T22:56:35.541Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq"
        },
        {
          "name": "https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6"
        },
        {
          "name": "https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624"
        },
        {
          "name": "https://docs.getdbt.com/docs/build/packages",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.getdbt.com/docs/build/packages"
        },
        {
          "name": "https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags"
        },
        {
          "name": "https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls"
        },
        {
          "name": "https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies"
        },
        {
          "name": "https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability"
        }
      ],
      "source": {
        "advisory": "GHSA-p3f3-5ccg-83xq",
        "discovery": "UNKNOWN"
      },
      "title": "Implicit override for built-in materializations from installed packages in dbt-core"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-40637",
    "datePublished": "2024-07-16T22:56:35.541Z",
    "dateReserved": "2024-07-08T16:13:15.511Z",
    "dateUpdated": "2024-08-02T04:33:11.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}