CVE-2023-30553 : Security Advisory and Response

Archery project suffers from multiple SQL injection vulnerabilities that affect versions up to 1.9.0. These vulnerabilities allow attackers to potentially query connected databases through unsafe user input handling in certain endpoints.

Understanding CVE-2023-30553

This CVE impacts the Archery project by allowing attackers to exploit multiple SQL injection vulnerabilities within specific APIs.

What is CVE-2023-30553?

Archery, an open-source SQL audit platform, is affected by multiple SQL injection vulnerabilities. These vulnerabilities exist in the

sql_api/api_workflow.py

endpoint

ExecuteCheck

, where user input from parameters like

db_name

and

full_sql

is not properly sanitized before being included in SQL queries.

The Impact of CVE-2023-30553

The vulnerabilities in Archery's

sql_api/api_workflow.py

endpoint can be exploited by attackers to manipulate SQL queries and potentially gain unauthorized access to databases.

Technical Details of CVE-2023-30553

The vulnerabilities arise due to unsafe concatenation of user input in various methods within Archery's SQL engine implementations.

Vulnerability Description

The vulnerabilities allow user input to be unsafely concatenated into SQL queries, leading to SQL injection exploits in methods like

execute_check

in

sql/engines/clickhouse.py

,

sql/engines/goinception.py

, and

sql/engines/oracle.py

.

Affected Systems and Versions

Versions up to 1.9.0 of the Archery project are affected by these SQL injection vulnerabilities.

Exploitation Mechanism

Attackers can utilize the improper handling of user input in the

sql_api/api_workflow.py

endpoint to craft SQL injection attacks and potentially compromise the connected databases.

Mitigation and Prevention

To address CVE-2023-30553, immediate steps should be taken to secure the affected systems and implement long-term security practices.

Immediate Steps to Take

Developers should sanitize user input, escape special characters, and utilize prepared statements to prevent SQL injection attacks. Additionally, upgrading to a patched version of Archery is advised.

Long-Term Security Practices

Regular security audits, code reviews, and security training for developers can help prevent similar vulnerabilities in the future.

Patching and Updates

Ensure that the Archery project is kept up-to-date with the latest security patches and fixes to mitigate the risk of SQL injection vulnerabilities.