CVE-2023-28424: 
vulnerability analysis and mitigation

CVE-2023-28424 affects Soko, the software that powers packages.gentoo.org, prior to version 1.0.2. The vulnerability involves SQL injection flaws in two package search handlers, Search and SearchFeed, implemented in pkg/app/handler/packages/search.go. These handlers are vulnerable to SQL injection via the q parameter, allowing unauthenticated attackers to execute arbitrary SQL queries on packages.gentoo.org (Gentoo Advisory, SonarSource Blog).

The vulnerability occurred despite the use of an Object-Relational Mapping (ORM) library and prepared statements. The issue stemmed from the misuse of a Golang ORM API where user input was directly interpolated into SQL queries instead of being properly escaped. The vulnerability was particularly present in the BuildSearchQuery() method where searchTerm parameter was directly concatenated into the query string rather than using query placeholders. The vulnerability received a CVSS v3.1 base score of 9.1 (Critical) (NVD, SonarSource Blog).

The vulnerability allowed attackers to execute arbitrary SQL queries on the database server. Due to a misconfiguration in the PostgreSQL container where the database user had superuser privileges, the SQL injection could be escalated to achieve remote code execution within the PostgreSQL container context. However, due to the isolation of Soko software components and the way Portage package manager works, users of Gentoo Linux were not at risk of supply-chain attacks (SonarSource Blog).

The vulnerability was patched in Soko version 1.0.2 through commit 4fa6e4b. The fix involved refactoring the query builder calls to follow proper documentation and implementing prepared statements to safely interpolate user-controlled data in SQL queries. Users running Soko on their infrastructure should upgrade to Soko 1.0.3 or above (Gentoo Patch, SonarSource Blog).

The Gentoo maintainers responded promptly to the vulnerability disclosure, with Arthur Zamarin and Sam James acknowledging the report and deploying a patch to production within 24 hours of the initial report. The vulnerability highlighted important lessons about the proper use of ORM APIs and the security implications of container configurations (SonarSource Blog).