SQL Injection Affecting blazer Open this link in a new tab package, versions <2.6.0


0.0
medium
  • Attack Complexity

    High

  • User Interaction

    Required

  • Scope

    Changed

  • Confidentiality

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-RUBY-BLAZER-2772730

  • published

    21 Apr 2022

  • disclosed

    21 Apr 2022

  • credit

    Al Chou

How to fix?

Upgrade blazer to version 2.6.0 or higher.

Overview

blazer is an allows you to explore your data with SQL. Easily create charts and dashboards, and share them with your team.

Affected versions of this package are vulnerable to SQL Injection by allowing specific variable values to modify the query rather than just the variable. This can occur if (1) the query's data source uses different escaping than the Rails database, or (2) the query has a variable inside a string literal. Since Blazer is designed to run arbitrary queries, the impact will typically be low. Users cannot run any queries they could not have already run. However, an attacker could get a user to run a query they would not have normally run. If the data source has write permissions, this could include modifying data in some cases.