Summary
JSON-SCADA before 0.65-alpha contains a SQL injection vulnerability in the opcApi() function. An authenticated user may inject SQL through HistoryReadRequest parameters, potentially reading, modifying, or deleting historian data across locations beyond the user's authorized role.
JSON-SCADA before 0.65-alpha contains a SQL injection vulnerability in the opcApi() function. An authenticated user may inject SQL through HistoryReadRequest parameters, potentially reading, modifying, or deleting historian data across locations beyond the user's authorized role.
Affected context
The vulnerability occurs in the JSON-SCADA real-time authentication server when opcApi() processes HistoryReadRequest values. Deployments may be at risk when authenticated request parameters such as NodeId.Id, StartTime, or EndTime are incorporated into SQL statements without sufficient parameterization and when database permissions allow access to historian records across multiple locations.
The vulnerability occurs in the JSON-SCADA real-time authentication server when opcApi() processes HistoryReadRequest values. Deployments may be at risk when authenticated request parameters such as NodeId.Id, StartTime, or EndTime are incorporated into SQL statements without sufficient parameterization and when database permissions allow access to historian records across multiple locations.
Exploit preconditions
- Attack surface: The authenticated HistoryReadRequest interface exposed through
opcApi() - Required access: Valid user authentication and permission to reach the affected API
- Trigger point: Processing of
NodeId.Id,StartTime, orEndTimerequest parameters - Why exploitation is possible: User-controlled values may be interpreted as SQL syntax rather than strictly constrained data, potentially allowing additional database statements to be processed
- Attack surface: The authenticated HistoryReadRequest interface exposed through
opcApi() - Required access: Valid user authentication and permission to reach the affected API
- Trigger point: Processing of
NodeId.Id,StartTime, orEndTimerequest parameters - Why exploitation is possible: User-controlled values may be interpreted as SQL syntax rather than strictly constrained data, potentially allowing additional database statements to be processed
Why this happens
The underlying bug is an injection flaw caused by combining untrusted request parameters with SQL statements without reliably separating data from executable query syntax. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The issue may be amplified when authorization checks are applied at the application layer but the resulting database queries are not constrained to the user's permitted location or records.
The underlying bug is an injection flaw caused by combining untrusted request parameters with SQL statements without reliably separating data from executable query syntax. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The issue may be amplified when authorization checks are applied at the application layer but the resulting database queries are not constrained to the user's permitted location or records.
Potential impact
- An attacker may read historian data from unauthorized locations.
- An attacker could modify stored operational or historical records.
- An attacker could delete historian data and affect availability or auditability.
- Database integrity and trust in monitoring information may be reduced.
- Excessive database privileges could increase the scope of compromise.
- An attacker may read historian data from unauthorized locations.
- An attacker could modify stored operational or historical records.
- An attacker could delete historian data and affect availability or auditability.
- Database integrity and trust in monitoring information may be reduced.
- Excessive database privileges could increase the scope of compromise.
General mitigation guidance
Mitigation generally focuses on ensuring that request data is treated strictly as data and that database access follows the application's authorization model.
Common defensive patterns include:
- Use parameterized queries or prepared statements for every database operation.
- Apply allowlisted validation and type constraints to identifiers and time-range values.
- Enforce location and role authorization at the query boundary, not only in surrounding application logic.
- Give the application database account only the minimum required read and write privileges.
- Separate read and administrative database capabilities where practical.
- Avoid exposing detailed database errors to authenticated clients.
- Preserve audit logs for history access and modification activity.
Mitigation generally focuses on ensuring that request data is treated strictly as data and that database access follows the application's authorization model.
Common defensive patterns include:
- Use parameterized queries or prepared statements for every database operation.
- Apply allowlisted validation and type constraints to identifiers and time-range values.
- Enforce location and role authorization at the query boundary, not only in surrounding application logic.
- Give the application database account only the minimum required read and write privileges.
- Separate read and administrative database capabilities where practical.
- Avoid exposing detailed database errors to authenticated clients.
- Preserve audit logs for history access and modification activity.
How teams detect issues like this
Organizations commonly detect SQL injection risks through:
- Static analysis rules identifying string concatenation or interpolation in SQL construction.
- Code review checks for database calls that accept direct request parameters.
- Tests using unexpected input types, delimiters, and statement-boundary characters without relying on production data.
- Database activity monitoring for anomalous statements, cross-location access, bulk changes, or deletion patterns.
- API policy enforcement requiring parameterized database access and centralized authorization checks.
Automated application-security and code-review tools can help identify unsafe query construction, but findings should be validated against the application's data-access layer.
Organizations commonly detect SQL injection risks through:
- Static analysis rules identifying string concatenation or interpolation in SQL construction.
- Code review checks for database calls that accept direct request parameters.
- Tests using unexpected input types, delimiters, and statement-boundary characters without relying on production data.
- Database activity monitoring for anomalous statements, cross-location access, bulk changes, or deletion patterns.
- API policy enforcement requiring parameterized database access and centralized authorization checks.
Automated application-security and code-review tools can help identify unsafe query construction, but findings should be validated against the application's data-access layer.
