CVE-2019-9039: SQL Injection in Couchbase Sync Gateway
Summary
CVE-2019-9039: SQL Injection in Couchbase Sync Gateway. Affects github.com/couchbase/sync_gateway versions < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Couchbase Sync Gateway is a component that synchronizes data between Couchbase Server and mobile devices. It provides a REST API for accessing and managing data. The vulnerability affects version 2.1.2 of Couchbase Sync Gateway in combination with a Couchbase Server. The REST API of the Sync Gateway is susceptible to a previously undisclosed N1QL-injection vulnerability. This vulnerability allows an attacker with access to the public REST API to insert additional N1QL statements through the parameters ?startkey? and ?endkey? of the ?_all_docs? endpoint.
Vulnerability Detail
The N1QL-injection vulnerability in Couchbase Sync Gateway's REST API can be exploited by an attacker to execute arbitrary N1QL statements. By manipulating the ?startkey? and ?endkey? parameters of the ?_all_docs? endpoint, an attacker can inject malicious N1QL code, leading to unauthorized access, data manipulation, or even remote code execution. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
2.5.0
This is the first release that contains the fix.
go get github.com/couchbase/sync_gateway@v2.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to restrict access to the public REST API of Couchbase Sync Gateway. This can be achieved by implementing network-level access controls or using a firewall to block access to the affected endpoints. However, applying the workaround is not a permanent solution, and upgrading to the fixed version is strongly advised.
Conclusion
The N1QL-injection vulnerability in Couchbase Sync Gateway's REST API poses a critical security risk. It allows an attacker to execute arbitrary N1QL statements, potentially leading to unauthorized access, data manipulation, or remote code execution. It is crucial to upgrade to the fixed version of Couchbase Sync Gateway (2.5.0 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/couchbase/sync_gateway →
FAQ
Couchbase Sync Gateway is a component that synchronizes data between Couchbase Server and mobile devices. It provides a REST API for accessing and managing data.
N1QL is a query language used by Couchbase Server to interact with JSON documents. It allows for powerful querying and manipulation of data.
The N1QL-injection vulnerability in Couchbase Sync Gateway's REST API allows an attacker to insert additional N1QL statements through the ?startkey? and ?endkey? parameters of the ?_all_docs? endpoint. This can lead to unauthorized access, data manipulation, or remote code execution.
This vulnerability has a CVSS score of 9.8, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade to version 2.5.0 or later of Couchbase Sync Gateway. Upgrade instructions can be found in the official documentation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/couchbase/sync_gateway.
