CVE-2022-30331: TigerGraph UDF Arbitrary Code Execution
Summary
CVE-2022-30331: The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Affects pytigergraph versions 0.0.0.5 – 1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TigerGraph is a graph database platform that provides powerful graph analytics capabilities. It allows users to define and execute custom queries using the GSQL query language. However, in version 3.6.0 of TigerGraph, there is a vulnerability in the User-Defined Functions (UDF) feature. This vulnerability allows the installation of a query without proper validation, enabling an attacker to execute arbitrary C++ code. The vendor's position is that this behavior is expected.
Vulnerability Detail
The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows the installation of a query (in the GSQL query language) without proper validation. This lack of validation opens up the possibility for an attacker to execute arbitrary C++ code. The impact of this vulnerability can be severe, as it grants unauthorized access to the underlying system and can lead to further compromise of sensitive data or disruption of services.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the vendor's patch or upgrade to a fixed version of TigerGraph to mitigate the risk of exploitation.
Conclusion
The User-Defined Functions (UDF) vulnerability in TigerGraph 3.6.0 allows the execution of arbitrary C++ code. To mitigate this risk, users should upgrade to a patched version or apply the vendor's fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pytigergraph →
FAQ
TigerGraph is a graph database platform that provides powerful graph analytics capabilities.
A User-Defined Function (UDF) is a feature in TigerGraph that allows users to define and execute custom queries using the GSQL query language.
This vulnerability allows an attacker to execute arbitrary C++ code, potentially leading to unauthorized access, data compromise, or service disruption.
No, there is no known workaround. It is crucial to apply the vendor's patch or upgrade to a fixed version of TigerGraph.
To fix this vulnerability, it is recommended to upgrade to a patched version of TigerGraph that includes proper validation of UDF installations.
