CVE-2024-45387: SQL Injection Vulnerability in Apache Traffic Control (Traffic Ops)
Summary
CVE-2024-45387: SQL injection in Apache Traffic Control. Affects github.com/apache/trafficcontrol/v8 versions >= 8.0.0, < 8.0.2. Fixed in 8.0.2. How to fix ↓
Also tracked for
The same CVE-2024-45387 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Traffic Control is an open-source software that provides a robust framework for managing and controlling the delivery of content across networks. It is designed to optimize the performance of web applications by intelligently routing traffic and managing caching. However, versions 8.0.0 to 8.0.1 of Traffic Ops are vulnerable to SQL injection, which can be exploited by privileged users.
Vulnerability Detail
An SQL injection vulnerability exists in Traffic Ops of Apache Traffic Control versions 8.0.1 and earlier, allowing users with roles such as 'admin', 'federation', 'operations', 'portal', or 'steering' to execute arbitrary SQL commands against the database. This vulnerability arises from improper handling of input in PUT requests, potentially leading to unauthorized data access or manipulation. The severity of this vulnerability is rated as critical, with a CVSS score of 9.9, indicating a high risk of exploitation.
How To Fix
Minimum fixed version
8.0.2
This is the first release that contains the fix.
go get github.com/apache/trafficcontrol/v8@v8.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Traffic Ops API to only trusted users or networks until the upgrade can be performed. This can be done by configuring firewall rules or API access controls to limit exposure.
Conclusion
The SQL injection vulnerability in Apache Traffic Control poses a significant risk to users with privileged access. It is crucial to upgrade to version 8.0.2 or later to mitigate this risk. Additionally, employing monitoring tools like Vulert can help in identifying and managing vulnerabilities proactively.
See every vulnerability recorded for github.com/apache/trafficcontrol/v8 →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by allowing attackers to execute arbitrary SQL queries against a database.
Any user with privileged roles in Apache Traffic Control versions 8.0.1 and earlier is at risk of exploitation through this SQL injection vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
An SQL injection attack can lead to unauthorized access to sensitive data, data manipulation, or even complete control over the database, which can severely impact the integrity and confidentiality of the application.
Yes, using Vulert, you can monitor and receive real-time alerts for open-source vulnerabilities in your software by simply using the Gopkg.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/apache/trafficcontrol/v8.
