Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-36830— SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.

Quick assessment

Affected
sqlfluff sqlfluff
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SQLFluff是一种方言灵活且可配置的 SQL linter。 SQLFluff 2.1.2之前版本存在注入漏洞，该漏洞源于允许攻击者通过libary_path调用任意python代码。

CVSS 6.3 · Medium EPSS 0.41% · P36

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-36830

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.
Source: CVE Program / CVE List V5
Vulnerability Description
SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the `library_path` config value to allow arbitrary python code to be executed via macros. For many users who use SQLFluff in the context of an environment where all users already have fairly escalated privileges, this may not be an issue - however in larger user bases, or where SQLFluff is bundled into another tool where developers still wish to give users access to supply their on rule configuration, this may be an issue. The 2.1.2 release offers the ability for the `library_path` argument to be overwritten on the command line by using the `--library-path` option. This overrides any values provided in the config files and effectively prevents this route of attack for users which have access to the config file, but not to the scripts which call the SQLFluff CLI directly. A similar option is provided for the Python API, where users also have a greater ability to further customise or override configuration as necessary. Unless `library_path` is explicitly required, SQLFluff maintainers recommend using the option `--library-path none` when invoking SQLFluff which will disable the `library-path` option entirely regardless of the options set in the configuration file or via inline config directives. As a workaround, limiting access to - or otherwise validating configuration files before they are ingested by SQLFluff will provides a similar effect and does not require upgrade.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
SQLFluff 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SQLFluff是一种方言灵活且可配置的 SQL linter。 SQLFluff 2.1.2之前版本存在注入漏洞，该漏洞源于允许攻击者通过libary_path调用任意python代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
sqlfluff sqlfluff < 2.1.2 -

II. Public POCs for CVE-2023-36830

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-36830

请登录查看更多情报信息。

Vendor Advisories for CVE-2023-36830 (1)

Other References for CVE-2023-36830 (1)

IV. Related Vulnerabilities

Same product: sqlfluff
Same vendor: sqlfluff
Same weakness: CWE-74