CVE-2022-24848 : Security Advisory and Response

DHIS2 is an information system for data capture, management, validation, analytics, and visualization. This article provides insights into CVE-2022-24848 affecting DHIS2 versions 2.36.10 and 2.37.6.

Understanding CVE-2022-24848

This section delves into the nature of the vulnerability and its potential impact.

What is CVE-2022-24848?

CVE-2022-24848 is a SQL injection security vulnerability that affects the

/api/programs/orgUnits?programs=

API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The vulnerability poses a risk to the confidentiality, integrity, and availability of the system.

The Impact of CVE-2022-24848

The exploitation of this vulnerability could enable an authenticated DHIS2 user to read, edit, and delete data in the DHIS2 instance's database. While the vulnerability requires a conscious attack from a logged-in user, its successful exploit can have severe consequences.

Technical Details of CVE-2022-24848

Explore the vulnerability's description, affected systems, and how the exploitation occurs.

Vulnerability Description

The vulnerability arises due to improper neutralization of special elements in an SQL command, leading to SQL injection via the API endpoint.

Affected Systems and Versions

DHIS2 versions <= 2.36.10 and >= 2.37, <= 2.37.6 are affected by this vulnerability.

Exploitation Mechanism

The vulnerability can be exploited by authenticated users through the

/api/programs/orgUnits?programs=

API endpoint, potentially compromising data.

Mitigation and Prevention

Learn about the immediate steps to secure your system and best practices for long-term security.

Immediate Steps to Take

Apply security patches available for DHIS2 versions 2.36.10.1 and 2.37.6.1. Consider implementing mitigations at the web proxy level as a temporary workaround.

Long-Term Security Practices

Enhance security awareness among DHIS2 users, conduct regular security audits, and stay informed about potential vulnerabilities.

Patching and Updates

Regularly update DHIS2 to the latest patched versions to mitigate known security risks.