Summary
FTS3 Web Monitoring has an unauthenticated SQL injection vulnerability in the /linkinfo endpoint. A remote attacker may use crafted source_se or dest_se query parameters to infer database contents and potentially read stored cloud-storage credentials and token-provider client secrets.
FTS3 Web Monitoring has an unauthenticated SQL injection vulnerability in the /linkinfo endpoint. A remote attacker may use crafted source_se or dest_se query parameters to infer database contents and potentially read stored cloud-storage credentials and token-provider client secrets.
Affected context
The issue affects FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0. It occurs in the /linkinfo endpoint handled by get_linkinfo, where the source_se and dest_se query parameters reach SQL processing without adequate protection.
The issue affects FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0. It occurs in the /linkinfo endpoint handled by get_linkinfo, where the source_se and dest_se query parameters reach SQL processing without adequate protection.
Exploit preconditions
- Attack surface: The
/linkinfoendpoint must be reachable over the network. - Required access: The vulnerability is described as unauthenticated; no prior login is required.
- Trigger point: Processing of the
source_seordest_sequery parameters byget_linkinfo. - Why exploitation is possible: Untrusted parameter values can influence SQL statements, allowing blind injection and inference of stored database data.
- Attack surface: The
/linkinfoendpoint must be reachable over the network. - Required access: The vulnerability is described as unauthenticated; no prior login is required.
- Trigger point: Processing of the
source_seordest_sequery parameters byget_linkinfo. - Why exploitation is possible: Untrusted parameter values can influence SQL statements, allowing blind injection and inference of stored database data.
Why this happens
The underlying issue is that untrusted query parameters affect SQL execution without sufficient separation between data and query structure. This is an SQL injection flaw mapped to CWE-89, which describes improper neutralization of special elements in SQL commands.
The underlying issue is that untrusted query parameters affect SQL execution without sufficient separation between data and query structure. This is an SQL injection flaw mapped to CWE-89, which describes improper neutralization of special elements in SQL commands.
Potential impact
- An attacker could infer database contents through blind SQL injection.
- Stored cloud-storage credentials may be exposed.
- Token-provider client secrets may be disclosed.
- Exposed credentials could enable unauthorized access to connected services, depending on their permissions.
- An attacker could infer database contents through blind SQL injection.
- Stored cloud-storage credentials may be exposed.
- Token-provider client secrets may be disclosed.
- Exposed credentials could enable unauthorized access to connected services, depending on their permissions.
General mitigation guidance
Defensive measures typically focus on ensuring user-controlled values remain data rather than executable SQL.
Common patterns include:
- Using parameterized queries or prepared statements for database access.
- Avoiding dynamic SQL construction with request parameters.
- Applying strict allowlists and appropriate type and length checks as defense in depth.
- Limiting database account privileges to the minimum needed by the endpoint.
- Protecting stored credentials with least-privilege access and reducing their exposure to application components.
Defensive measures typically focus on ensuring user-controlled values remain data rather than executable SQL.
Common patterns include:
- Using parameterized queries or prepared statements for database access.
- Avoiding dynamic SQL construction with request parameters.
- Applying strict allowlists and appropriate type and length checks as defense in depth.
- Limiting database account privileges to the minimum needed by the endpoint.
- Protecting stored credentials with least-privilege access and reducing their exposure to application components.
How teams detect issues like this
Useful detection approaches include:
- Static analysis rules that flag SQL queries built through string concatenation or interpolation with request data.
- Code review of
get_linkinfoand other handlers that pass query parameters to database operations. - Runtime monitoring for unusual requests to
/linkinfo, repeated parameter variations, and anomalous database errors or query behavior. - Policy checks that require parameterized database access and least-privilege database permissions.
Useful detection approaches include:
- Static analysis rules that flag SQL queries built through string concatenation or interpolation with request data.
- Code review of
get_linkinfoand other handlers that pass query parameters to database operations. - Runtime monitoring for unusual requests to
/linkinfo, repeated parameter variations, and anomalous database errors or query behavior. - Policy checks that require parameterized database access and least-privilege database permissions.
