Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-36084— cruddl vulnerable to AQL injection through flexSearch

Quick assessment

Affected
AEB-labs cruddl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

cruddl是德国AEB开源的一个库。用于为您的数据库创建一个 GraphQL API，使用 GraphQL SDL 为您的架构建模。 cruddl 存在安全漏洞，攻击者利用该漏洞可以能够注入任意 AQL 查询，这些查询将被转发到 ArangoDB 并由 ArangoDB 执行。

CVSS 9.9 · Critical EPSS 1.43% · P72

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-36084

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
cruddl vulnerable to AQL injection through flexSearch
Source: CVE Program / CVE List V5
Vulnerability Description
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5
Vulnerability Title
cruddl 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
cruddl是德国AEB开源的一个库。用于为您的数据库创建一个 GraphQL API，使用 GraphQL SDL 为您的架构建模。 cruddl 存在安全漏洞，攻击者利用该漏洞可以能够注入任意 AQL 查询，这些查询将被转发到 ArangoDB 并由 ArangoDB 执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
AEB-labs cruddl >= 3.0.0, < 3.0.2 -

II. Public POCs for CVE-2022-36084

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-36084

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-36084 (2)

Vendor Advisories for CVE-2022-36084 (1)

IV. Related Vulnerabilities

Same weakness: CWE-943

V. Comments for CVE-2022-36084

No comments yet

Leave a comment