Horizon Alert
Summary of the vulnerability and why it matters
A SQL injection vulnerability in Rucio allows any authenticated user to execute arbitrary SQL commands against the PostgreSQL database. This happens when the `postgres_meta` plugin is enabled and user-supplied search filters are improperly handled. If exploited, this could lead to exposure or modification of sensitive data.
- Affects Rucio metadata storage.
- Can expose or modify sensitive data.
- Requires existing user authentication.
Attack Path
How an attacker could exploit the issue
An authenticated attacker can exploit this SQL injection by sending crafted requests to the DID search endpoint. This allows them to execute arbitrary SQL commands against the Rucio metadata database. The impact can range from data exfiltration and modification to potential code execution depending on database permissions.
- Requires authenticated user access.
- Targets the DID search endpoint.
- `postgres_meta` plugin must be enabled.
Live Threat
Current exploitation, exposure, and threat context
This SQL injection vulnerability in Rucio's DID search endpoint is concerning because it allows any authenticated user to execute arbitrary SQL. While this doesn't immediately pose a public threat, it could allow an insider to access or manipulate sensitive data within an organization's Rucio deployment. The direct interpolation of attacker-controlled data into SQL queries, even with `psycopg3`'s `sql.SQL()`, is a significant flaw.
- Requires authenticated access.
- Affects deployments using `postgres_meta`.
- Exploitable via DID search endpoint.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Rucio to 35.8.5, 38.5.5, 39.4.2, or 40.1.1 to address the SQL injection vulnerability, especially if the `postgres_meta` plugin is in use. If immediate patching is not feasible, isolate affected services or restrict access to the DID search endpoint to mitigate risk.
- Apply Rucio versions 35.8.5, 38.5.5, 39.4.2, or 40.1.1.
- Block network access to DID search endpoints.
- Monitor logs for suspicious SQL queries.
