Loading vulnerability…
SQL Injection in Cyrus SASL SQL Plugin
CVE-2022-24407 is a SQL injection vulnerability in the SQL plugin of Cyrus SASL versions 2.1.17 through 2.1.27. The sql_auxprop_store function fails to properly quote or escape a password property value passed as the fifth argument to sql_create_statement when constructing INSERT or UPDATE statements. An authenticated remote attacker able to change a password can submit crafted SQL syntax within the password value to execute arbitrary SQL commands, potentially modifying other accounts' passwords and escalating privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of the backing SQL database, subject to the database permissions available to the application. An attacker may change other accounts' passwords, enabling account takeover and privilege escalation. Arbitrary SQL execution may also permit unauthorized data access, modification, or deletion.
If you can’t patch tonight, do this now.
Until patched, restrict password-change operations to trusted authenticated users and limit network access to services exposing the affected SASL password-update functionality. Apply least-privilege database permissions to the SQL-plugin database account so it cannot modify unrelated data or perform administrative database operations.
Patch, then assume compromise.
Upgrade Cyrus SASL to version 2.1.28 or later, or install a distribution-supported package containing the backported fix for CVE-2022-24407. For packaged deployments, apply the applicable vendor security update, including RLSA-2022:0658 for Rocky Linux 8 or the corresponding Red Hat advisory for the installed release. Update affected bundled components through their product vendor's supported security releases.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.