SQL Injection Affecting blazer package, versions <2.6.0


0.0
medium

Snyk CVSS

    Attack Complexity High
    User Interaction Required
    Scope Changed
    Confidentiality High

    Threat Intelligence

    EPSS 0.07% (31st percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-BLAZER-2772730
  • published 21 Apr 2022
  • disclosed 21 Apr 2022
  • credit Al Chou

How to fix?

Upgrade blazer to version 2.6.0 or higher.

Overview

blazer is an allows you to explore your data with SQL. Easily create charts and dashboards, and share them with your team.

Affected versions of this package are vulnerable to SQL Injection by allowing specific variable values to modify the query rather than just the variable. This can occur if (1) the query's data source uses different escaping than the Rails database, or (2) the query has a variable inside a string literal. Since Blazer is designed to run arbitrary queries, the impact will typically be low. Users cannot run any queries they could not have already run. However, an attacker could get a user to run a query they would not have normally run. If the data source has write permissions, this could include modifying data in some cases.