This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: CVE-2021-47748 is a critical **OS Command Injection** flaw in Hasura GraphQL Engine. π **Consequences**: Attackers can execute **arbitrary shell commands** via SQL queries.β¦
π‘οΈ **Root Cause**: **CWE-78** (OS Command Injection). The flaw stems from improper handling of **SQL query operations**. Malicious input in SQL queries is interpreted as executable system commands by the backend.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: **Hasura GraphQL Engine**. Specifically, **Version 1.3.3** is vulnerable. π’ **Vendor**: Hasura. π **Product**: GraphQL Server. Check your deployment version immediately!
Q4What can hackers do? (Privileges/Data)
π **Attacker Power**: Full **Remote Code Execution**. π **Data Access**: Can read/write any file on the server. π **Privileges**: Execute commands with the **same privileges** as the Hasura process.β¦
β οΈ **Threshold**: **LOW**. CVSS Vector: `AV:N/AC:L/PR:N/UI:N`. π« **No Auth Required**: Publicly exploitable without authentication. π **Network Accessible**: Exploitable over the network. High severity (CVSS 3.1).
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exploit**: **YES**. ExploitDB ID **49802** is available. π’ **Advisory**: VulnCheck has published a detailed advisory. β οΈ **Risk**: Wild exploitation is likely since PoC code is public.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: 1. Identify if you run **Hasura GraphQL Engine**. 2. Verify version is **1.3.3**. 3. Scan for exposed GraphQL endpoints. 4. Check logs for unusual SQL injection patterns targeting command execution.
Q8Is it fixed officially? (Patch/Mitigation)
π§ **Official Fix**: **YES**. Hasura has released patches. π₯ **Action**: Upgrade to a **fixed version** immediately. Visit the [GitHub Repository](https://github.com/hasura/graphql-engine) for the latest secure release.β¦
π§ **No Patch?**: 1. **Isolate** the server from the internet. 2. **Restrict** network access to trusted IPs only. 3. **Monitor** logs for command injection attempts. 4.β¦
π₯ **Urgency**: **CRITICAL / IMMEDIATE**. π¨ **Priority**: P0. With **No Auth** and **Public Exploits**, this is an active threat. π **Action**: Patch or isolate **TODAY**. Do not wait for scheduled maintenance.