Summary
UTMStack before 11.2.16 contains a SQL injection vulnerability in the asset group search functionality. An authenticated attacker may provide crafted assetType or groupName values to alter a native PostgreSQL query, potentially enabling database access or modification and, depending on database privileges, filesystem-related actions.
Affected context
The vulnerability occurs in UTMStack's asset group search endpoint when user-controlled filter values are incorporated into a native PostgreSQL query. Deployments may be at risk when authenticated users can reach GET /api/utm-asset-groups/searchGroupsByFilter and the backend constructs SQL through string formatting without parameterized binding or equivalent input controls.
Exploit preconditions
- Attack surface: The authenticated asset group search API endpoint
- Required access: Valid authentication with access to the affected search functionality
- Trigger point: Processing of attacker-controlled
assetTypeorgroupNamefilter values - Why exploitation is possible: Untrusted values are inserted into a native SQL statement without reliable parameterization or context-aware escaping
- Privilege dependency: The consequences depend on the database account privileges available to the UTMStack service
Why this happens
The underlying bug is an unsafe construction of a native SQL query using string formatting with values received from an API request. Because the input is treated as part of the SQL statement rather than strictly as data, an authenticated requester may influence query structure. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection).
Potential impact
- An attacker may read sensitive database records
- An attacker could modify, delete, or corrupt stored data
- The attacker may bypass intended query restrictions
- Database credentials or application secrets could be exposed
- Filesystem access may be possible if the database configuration and privileges permit it
- Compromised data could affect monitoring, asset inventories, or downstream security workflows
General mitigation guidance
Mitigation generally centers on removing SQL construction from untrusted strings and reducing the privileges available to application database accounts.
Common defensive patterns include:
- Use parameterized queries, prepared statements, or safe query-builder APIs for every dynamic value
- Apply allowlisted validation for fields with a constrained set of valid values
- Treat search filters as data and avoid interpolating them into SQL syntax
- Enforce least-privilege permissions for the application database role
- Separate database accounts or schemas when different operations require distinct privilege levels
- Avoid exposing database or filesystem capabilities that are unnecessary for normal application behavior
- Return generic errors that do not disclose SQL statements, schema details, or database credentials
How teams detect issues like this
Detection can combine source review, runtime monitoring, and policy enforcement:
- Use static analysis rules to identify string formatting, concatenation, or interpolation inside SQL execution paths
- Review query-building code for request parameters flowing into native SQL without bound parameters
- Monitor database logs for unexpected syntax, comment markers, abnormal query structures, or unusual access to system catalogs
- Alert on authenticated accounts issuing atypical volumes or patterns of asset-group searches
- Enforce code-review policies requiring parameterized queries for database access
- Use automated security review tools as a supplementary check for injection-prone data flows
