CVE-2021-27021: 
Puppet vulnerability analysis and mitigation

A flaw was discovered in Puppet DB (CVE-2021-27021) that results in an escalation of privileges which allows a user with read access to PuppetDB to delete tables via an SQL query. The vulnerability was disclosed on June 24, 2021, and affects multiple versions of Puppet DB, Puppet Enterprise, and Puppet Platform (Puppet Advisory).

The vulnerability is classified as an SQL Injection (CWE-89) with a CVSS 3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability allows for improper neutralization of special elements used in SQL commands, enabling privilege escalation through malicious SQL queries (NVD).

The vulnerability enables users with read access to escalate their privileges and perform unauthorized database operations, specifically the ability to delete tables via SQL queries. This could lead to significant data loss and system integrity issues (Puppet Advisory).

The vulnerability requires network access and low privilege levels to exploit, with no user interaction needed. The attack complexity is considered low, making it relatively straightforward to exploit for attackers with basic access to the system (NVD).

The vulnerability has been patched in multiple versions: Puppet DB 6.17.0 and 7.4.1, Puppet Enterprise 2019.8.7 and 2021.2, and Puppet Platform 6.23 and 7.8.0. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Puppet Advisory).