Summary
Mautic's dashboard widget data API does not adequately validate chart filter parameters before incorporating them into reporting database queries. An authenticated API user may exploit this weakness to infer or retrieve arbitrary database data, including marketing records and password hashes, and may also cause limited query-related service degradation when the API is enabled.
Mautic's dashboard widget data API does not adequately validate chart filter parameters before incorporating them into reporting database queries. An authenticated API user may exploit this weakness to infer or retrieve arbitrary database data, including marketing records and password hashes, and may also cause limited query-related service degradation when the API is enabled.
Affected context
The vulnerability occurs in the dashboard widget data API endpoint (/api/data/{type}) when client-supplied chart filters are used to construct database queries without sufficient validation or safe parameter handling. Exploitation depends on the Mautic API being enabled and the attacker having authenticated API access. The affected query paths are reporting operations that generate dashboard chart data.
The vulnerability occurs in the dashboard widget data API endpoint (/api/data/{type}) when client-supplied chart filters are used to construct database queries without sufficient validation or safe parameter handling. Exploitation depends on the Mautic API being enabled and the attacker having authenticated API access. The affected query paths are reporting operations that generate dashboard chart data.
Exploit preconditions
- Attack surface: Mautic's dashboard widget data API endpoint - Required access: An authenticated user with API access - Deployment condition: The Mautic API must be enabled - Trigger point: Processing chart filter parameters for dashboard data - Why exploitation is possible: Untrusted filter values reach database query
construction without adequate validation or parameterization
- Attack surface: Mautic's dashboard widget data API endpoint - Required access: An authenticated user with API access - Deployment condition: The Mautic API must be enabled - Trigger point: Processing chart filter parameters for dashboard data - Why exploitation is possible: Untrusted filter values reach database query
construction without adequate validation or parameterization
Why this happens
The underlying flaw is improper neutralization of special elements in client-controlled database query input. Chart filter parameters are treated as trusted query components rather than as data bound through a safe, parameterized interface. This behavior maps to CWE-89, SQL Injection, and permits attacker-controlled query logic to influence reporting queries.
The underlying flaw is improper neutralization of special elements in client-controlled database query input. Chart filter parameters are treated as trusted query components rather than as data bound through a safe, parameterized interface. This behavior maps to CWE-89, SQL Injection, and permits attacker-controlled query logic to influence reporting queries.
Potential impact
- An attacker may read arbitrary information from the Mautic database.
- Contact and other marketing data could be disclosed.
- User account information, including password hashes, could be exposed.
- Crafted queries may slow database operations and could reduce availability.
- Data modification is not expected through this vulnerability.
- An attacker may read arbitrary information from the Mautic database.
- Contact and other marketing data could be disclosed.
- User account information, including password hashes, could be exposed.
- Crafted queries may slow database operations and could reduce availability.
- Data modification is not expected through this vulnerability.
General mitigation guidance
Mitigation generally centers on ensuring that all chart filters are treated as untrusted data. Use parameterized queries or safe query-builder interfaces, allow only explicitly supported filter fields and operators, and validate values against strict type, format, and range constraints. Avoid dynamically concatenating client input into SQL, minimize database account privileges, and limit access to reporting endpoints and sensitive records. Secure-by-default deployments should keep unnecessary API exposure disabled and apply consistent authorization checks to dashboard data operations.
Mitigation generally centers on ensuring that all chart filters are treated as untrusted data. Use parameterized queries or safe query-builder interfaces, allow only explicitly supported filter fields and operators, and validate values against strict type, format, and range constraints. Avoid dynamically concatenating client input into SQL, minimize database account privileges, and limit access to reporting endpoints and sensitive records. Secure-by-default deployments should keep unnecessary API exposure disabled and apply consistent authorization checks to dashboard data operations.
How teams detect issues like this
Detection can include static analysis for string concatenation or formatting of request parameters into SQL, review of query-builder usage in dashboard APIs, and checks that every filter is validated and parameter-bound. Code review should examine alternate query branches, sorting and filtering clauses, and error-handling paths. Runtime monitoring can alert on unusual filter syntax, repeated timing-based requests, database errors, and unexpectedly expensive reporting queries. Automated review tools and database activity monitoring can supplement these controls.
Detection can include static analysis for string concatenation or formatting of request parameters into SQL, review of query-builder usage in dashboard APIs, and checks that every filter is validated and parameter-bound. Code review should examine alternate query branches, sorting and filtering clauses, and error-handling paths. Runtime monitoring can alert on unusual filter syntax, repeated timing-based requests, database errors, and unexpectedly expensive reporting queries. Automated review tools and database activity monitoring can supplement these controls.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
