Chartbrewの脆弱性3件、修正版5.2.3が公開
Summary
Chartbrewに、公開チャートへのSQLインジェクション、既定の秘密鍵によるなりすまし、キュー管理画面の認証欠如の3件が公表されました。5.2.3以降に更新し、CB_SECRETの値と/apps/queuesの公開状況も確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Chartbrewに、公開チャートへのSQLインジェクション、既定の秘密鍵によるなりすまし、キュー管理画面の認証欠如の3件が公表されました。5.2.3以降に更新し、CB_SECRETの値と/apps/queuesの公開状況も確認してください。
Original description The description as published by the source.
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape backslashes for MySQL and MariaDB quoted contexts. The vulnerable surface is public and embedded dashboard/chart requests that call applyMysqlOrPostgresVariables. An unauthenticated user sends crafted URL filter values to a public or embedded chart backed by a stored SQL query. Replacement-string dollar sequences can alter SQL independently of the database engine, while MySQL and MariaDB backslash handling provides a second quoted-string escape path. The target must expose a public or embedded chart using URL-controlled variables in a SQL query; only the backslash branch is specific to MySQL and MariaDB. Injected SQL can read, modify, or delete data available to the configured database account. This issue is fixed in version 5.2.1.
Source: CVE.org (CVE Program・cvelistV5) NVD