CVE-2024-35181: 
vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in Meshery prior to version 0.7.22. Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications (NVD). The vulnerability was identified in the GetMeshSyncResourcesKinds function at the API URL '/api/system/meshsync/resources/kinds', where the order query parameter is directly used to build a SQL query in meshsync_handler.go (GitHub Security Lab).

The vulnerability exists due to improper handling of the order query parameter in the GetMeshSyncResourcesKinds function. The parameter is directly used in SQL query construction without proper sanitization, allowing for SQL injection attacks through stacked queries payload and the ATTACH DATABASE command. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N (NVD).

Successful exploitation of this vulnerability could allow attackers to access and modify any data stored in the database, including performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. Additionally, attackers could leverage the vulnerability to perform arbitrary file writes using SQL injection stacked queries payload (GitHub Security Lab).

The vulnerability requires low privileges and no user interaction to exploit, though it has high attack complexity. An attacker needs to have access to the API endpoint and can exploit the vulnerability by manipulating the order parameter in requests to '/api/system/meshsync/resources/kinds' (GitHub Security Lab).

The vulnerability has been fixed in Meshery version 0.7.22. The fix involves implementing proper input sanitization for the order parameter using the SanitizeOrderInput function. Users are advised to upgrade to version 0.7.22 or later to mitigate this vulnerability (GitHub PR).