CVE-2021-31856

CRITICALNuclei

Layer5 Meshery 0.5.2 - SQL Injection

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-31856 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Repository PoCs

GitHubssst0n3/CVE-2021-31856Repository PoCby ssst0n30Not analyzed2 files

994.3 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALLayer5 Meshery 0.5.2 - SQL InjectionCVSS 9.8

Layer5 Meshery 0.5.2 contains a SQL injection vulnerability in the REST API that allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to a patched version of Layer5 Meshery or apply the necessary security patches to mitigate the SQL Injection vulnerability (CVE-2021-31856).

WeaknessesCWE-89
Authorsprincechaddha
Template tagscve2021cvesqlilayer5vuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:layer5:meshery:0.5.2:*:*:*:*:*:*:*
https://github.com/ssst0n3/CVE-2021-31856 https://nvd.nist.gov/vuln/detail/CVE-2021-31856 https://meshery.io/ https://github.com/layer5io/meshery/pull/2745 https://github.com/ssst0n3/my_vulnerabilities

Source: ProjectDiscovery

References

3