Executive Summary

A SQL injection vulnerability has been identified in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1. This vulnerability allows a remote unauthenticated attacker to send specially crafted SQL statements, potentially allowing them to view, add, modify, or delete information in the back-end database. The vulnerability has a CVSS score of 8.6, indicating high severity.

Technical Analysis

The vulnerability is classified as a SQL injection (CWE-89) issue. The attack vector is network-based (AV:N), with low attack complexity (AC:L) and no privileges required (PR:N). The vulnerability affects the IBM Enterprise Build of Quarkus product, specifically versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1. The root cause of the vulnerability is likely due to inadequate input validation or sanitization of user-supplied SQL statements.

How It Gets Exploited

An unauthenticated remote attacker could send specially crafted SQL statements to the vulnerable application. For example, the attacker might send a malicious SQL query to the application's database interface, which would then execute the query with elevated privileges. This could allow the attacker to access sensitive data, modify database contents, or perform other malicious actions. The attack would likely involve sending a crafted SQL payload to a vulnerable endpoint, which would then be executed by the database.

Impact Assessment

The vulnerability affects IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1. Successful exploitation could allow an attacker to view, add, modify, or delete information in the back-end database, potentially leading to data breaches or unauthorized data modifications. The CVSS score of 8.6 indicates a high severity level, with high impacts on confidentiality (C:H), low impacts on integrity (I:L) and availability (A:L).

Recommended Actions

To mitigate this vulnerability, it is recommended to update IBM Enterprise Build of Quarkus to version 3.27.5.SP2 or later, or to version 3.33.3.SP2 or later. Additionally, users should:
  • Review and sanitize user-supplied input to prevent SQL injection attacks.
  • Implement prepared statements with parameterized queries to separate code from user input.
  • Limit database privileges to the minimum required for the application to function.
  • Monitor database activity for suspicious queries or unauthorized access attempts.

Sources