Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in migration-planner, allowing authenticated attackers to execute malicious SQL commands by uploading a specially crafted RVTools spreadsheet. This could lead to the exposure of sensitive credentials and compromise the entire SaaS environment.
- Attackers can inject malicious code via spreadsheets.
- Sensitive credentials could be exposed by exploitation.
- Assess tool usage and potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker who has already gained authenticated access can upload a malicious `.xlsx` file to the migration-planner. This file contains embedded SQL code in its spreadsheet cells. When the application processes cluster names from this file, it fails to properly sanitize the input, leading to the execution of the embedded SQL code. This vulnerability can then be leveraged to read arbitrary files from the system, potentially leading to a complete compromise of the SaaS environment.
- Attacker must be authenticated.
- Specially crafted file upload triggers SQL injection.
- Leads to sensitive data exposure.
Live Threat
Current exploitation, exposure, and threat context
A remote authenticated attacker can exploit this vulnerability by uploading a malicious RVTools .xlsx file. When cluster names are processed, SQL injection within a spreadsheet cell can execute, allowing arbitrary file reading on the system. This could expose sensitive information like Kubernetes service account tokens and other credentials, potentially leading to a full compromise of the SaaS environment.
- Sensitive system and user credentials.
- Upload malicious file to trigger SQL injection.
- Full SaaS environment compromise.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This critical vulnerability in migration-planner requires immediate attention from teams managing SaaS environments and infrastructure. Exploitation of this SQL injection flaw allows remote authenticated attackers to read arbitrary files, potentially leading to a full compromise of sensitive credentials and the entire SaaS environment. The first practical step is to identify all instances of migration-planner, confirm their accessibility and business criticality, and identify the accountable owner for remediation planning.
- Application and Platform teams own the issue.
- Verify migration-planner instances and reachability.
- Plan remediation based on verified risk.
