Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #10839 SQL injection in tracker report search when a criteria is a cross references or a permissions on artifact field
    Actions
    Infos
    #10839
    Thomas Gerbet (tgerbet)
    2017-12-11 13:11
    2017-11-21 11:22
    11068
    Details
    SQL injection in tracker report search when a criteria is a cross references or a permissions on artifact field

    Tuleap does not sanitize properly user inputs when constructing SQL queries for a tracker report when a criteria is a cross reference or a permissions on artifact field.

    Impact

    An attacker with access to a tracker report with a cross references criteria could execute arbitrary SQL queries.
    CVSSv3 score: 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

    Exploitation

    Put the character ' into the cross reference criteria of a tracker report, you will get a DB error caused by the resulting broken query.

    References

    CWE-89
    https://www.owasp.org/index.php/SQL_Injection

    Trackers
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2017-11-21
    Attachments
    Artifact links

    Releases

    Fixed in

    Artifact ID Project Tracker Summary Status Last Update Date Submitted By Assigned to
    rel #10588 Tuleap Releases 9.15 Delivered 2017-12-07 17:01 Manuel Vacelet (vaceletm)
    Empty
    References
    Referencing request #10839

    Git commit

    tuleap/tuleap/stable

    Merge commit 'refs/changes/68/9968/2' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD c9c2610f7f
    User avatar Joris MASSON (jmasson) , 2017-11-21 15:07
    request #10839: SQL injection in tracker report search when a criteria is a cross references or a permissions on artifact field 3076778566
    User avatar Thomas Gerbet (tgerbet) , 2017-11-21 12:47
    Referenced by request #10839

    Artifact Tracker v5

    rel #10588 9.15

    Other

    gerrit #9968
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2017-11-21 11:59
    Issue is also present with the "Permissions on artifact" field.
    • Summary
      -SQL injection in tracker report search when a criteria is a cross references field 
      +SQL injection in tracker report search when a criteria is a cross references or a permissions on artifact field 
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes