CVE-2022-21687: Command injection in gh-ost
Summary
CVE-2022-21687: Command injection in gh-ost. Affects github.com/github/gh-ost versions < 1.1.3. Fixed in 1.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is gh-ost, a tool developed by GitHub for performing online schema migrations on MySQL databases. It allows users to alter database schemas with minimal downtime. The tool is written in Go and is commonly used in production environments. However, versions up to 1.1.2 of gh-ost are vulnerable to command injection.
Vulnerability Detail
The vulnerability in gh-ost version <= 1.1.2 allows users to inject DSN (Data Source Name) strings via the -database parameter. This can be exploited by an attacker who has access to the target host or can trick an administrator into executing a malicious gh-ost command on a host running gh-ost. Additionally, network access from the host running gh-ost to the attacker's malicious MySQL server is required. The impact of this vulnerability is arbitrary local file read, which can lead to unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.1.3
This is the first release that contains the fix.
go get github.com/github/gh-ost@v1.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability.
Conclusion
In conclusion, the gh-ost package up to version 1.1.2 is vulnerable to command injection, which can lead to arbitrary local file read. It is recommended to upgrade to version 1.1.3 or above to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/github/gh-ost →
FAQ
The severity of this vulnerability is moderate, with a CVSS score of 6.8.
The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost. Additionally, network access from the host running gh-ost to the attacker's malicious MySQL server is required.
This vulnerability may lead to arbitrary local file read, potentially allowing unauthorized access to sensitive information.
Yes, the vulnerability has been fixed in version 1.1.3 and above of gh-ost.
You can find more information about this vulnerability in the advisory published at https://advisory.dw1.io/51.
