Horizon Alert
Summary of the vulnerability and why it matters
A SQL injection vulnerability in Saltcorn allows authenticated users to execute arbitrary SQL commands. This could lead to the theft of sensitive data, including administrator passwords and configuration secrets, and potentially allow modification or deletion of the database.
- Sensitive data exfiltration is possible.
- Database modification or destruction may occur.
- Affects Saltcorn's no-code builder.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this SQL injection flaw by leveraging an existing low-privilege account. By manipulating sync parameters, they could exfiltrate sensitive database information, including credentials and secrets, or even alter and destroy data. This impacts any user with read access to at least one table.
- Requires low-privilege authentication.
- Targets mobile-sync routes.
- Exfiltrates or modifies database.
Live Threat
Current exploitation, exposure, and threat context
This SQL injection vulnerability in Saltcorn affects all versions prior to specific patch releases, allowing authenticated low-privilege users to access and potentially modify the entire database. Attackers are drawn to this type of vulnerability because it offers direct access to sensitive data, including credentials and configuration secrets, and can lead to complete data compromise. The ability to exfiltrate or alter data from a database is a common and valuable objective for threat actors.
- Exploitable by authenticated users.
- Enables full database compromise.
- Fixes available in patch releases.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Saltcorn to versions 1.4.6, 1.5.6, or 1.6.0-beta.5 to address the critical SQL injection vulnerability. If immediate patching is not feasible, isolate affected services to prevent unauthorized database access and exfiltration by authenticated users. Monitor logs for unusual sync activity or unauthorized data access attempts.
- Update Saltcorn to a fixed version.
- Isolate vulnerable services if patching is delayed.
- Monitor for suspicious sync activity.
