CVE-2024-29031: 
vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in Meshery prior to version 0.7.17. The vulnerability exists in the order parameter of GetMeshSyncResources API endpoint, allowing remote attackers to obtain sensitive information. The issue was discovered and reported by GitHub CodeQL team member Tony Torralba (GitHub Advisory).

The vulnerability exists in the GetMeshSyncResources function exposed at the API URL /api/system/meshsync/resources. The order query parameter was directly used to build a SQL query without proper sanitization in the meshync_handler.go file. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with no required privileges or user interaction (NVD).

The vulnerability could allow attackers to access and modify any data stored in the database, including performance profiles containing session cookies, Meshery application data, or any Kubernetes configuration added to the system. Additionally, attackers may be able to execute arbitrary file write operations using SQL injection stacked queries payload and the ATTACH DATABASE command (GitHub Advisory).

The vulnerability can be exploited by sending specially crafted requests to the affected endpoint. A proof of concept demonstrates that an attacker can write files at arbitrary locations with arbitrary contents using a series of HTTP requests to the vulnerable endpoint. The exploitation requires appropriate authentication cookies for local authentication (GitHub Advisory).

The vulnerability has been patched in Meshery version 0.7.17. The fix involves implementing proper input sanitization using the SanitizeOrderInput function to validate the order parameter. Users are strongly recommended to upgrade to version 0.7.17 or later to address this security issue (NVD, GitHub PR).