SQL Injection Affecting blazer package, versions <2.6.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-BLAZER-2772730
- published 21 Apr 2022
- disclosed 21 Apr 2022
- credit Al Chou
Introduced: 21 Apr 2022
CVE-2022-29498 Open this link in a new tabHow to fix?
Upgrade blazer to version 2.6.0 or higher.
Overview
blazer is an allows you to explore your data with SQL. Easily create charts and dashboards, and share them with your team.
Affected versions of this package are vulnerable to SQL Injection by allowing specific variable values to modify the query rather than just the variable. This can occur if (1) the query's data source uses different escaping than the Rails database, or (2) the query has a variable inside a string literal. Since Blazer is designed to run arbitrary queries, the impact will typically be low. Users cannot run any queries they could not have already run. However, an attacker could get a user to run a query they would not have normally run. If the data source has write permissions, this could include modifying data in some cases.