CVE-2022-24407: SQL Injection
A flaw was found in the SQL plugin shipped with Cyrus SASL. The vulnerability occurs due to failure to properly escape SQL input and leads to an improper input validation vulnerability. This flaw allows an attacker to execute arbitrary SQL commands and the ability to change the passwords for other accounts allowing escalation of privileges.
Other sources
A SQL injection attack has been discovered in the SQL plugin shipped with Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28. Due to failure to properly escape SQL input, an attacker can execute arbitrary SQL commands. This can allow, among other things, the ability to change the passwords for other accounts allowing escalation of privileges. The issue is in sqlauxpropstore, plugins/sql.c, and in particular the 5th parameter of sqlcreatestatement for the insert/update SQL command. Currently it takes the value of the property as is, without quoting. If one uses a password containing a closing ' and continues with valid SQL syntax, then exploitation is possible.
— Red Hat
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-24407?
The severity of CVE-2022-24407 is high (8.8).
What is the affected software of CVE-2022-24407?
The affected software of CVE-2022-24407 includes Cyrus SASL version 2.1.17 through 2.1.27.
How does CVE-2022-24407 occur?
CVE-2022-24407 occurs due to failure to properly escape SQL input in the SQL plugin shipped with Cyrus SASL.
What is the potential impact of CVE-2022-24407?
The potential impact of CVE-2022-24407 is the execution of arbitrary SQL commands and the ability to change passwords for other accounts.
How can I fix CVE-2022-24407?
To fix CVE-2022-24407, update to Cyrus SASL version 2.1.28.