Network security firm SonicWall rolled out fixes Friday to mitigate a critical SQL Injection (SQLi) vulnerability affecting its Analytics On-Prem and Global Management System (GMS) products.
The vulnerability, tracked as CVE-2022-22280gets a 9.4 severity on the CVSS scoring system and stems from what the company describes as an “incorrect neutralization of special elements” used in an SQL command that could lead to an unauthenticated SQL injection.
“Without sufficient removal or citation of SQL syntax in user-controllable inputs, the generated SQL query may cause that input to be interpreted as SQL rather than regular user data,” MITER notes in the description of SQL injection.
“This can be used to modify the query logic to bypass security checks, or to insert additional statements that modify the back-end database, possibly including running system commands.”
H4lo and Catalpa from DBappSecurity HAT Lab are credited with discovering and reporting the flaws affecting 18.104.22.168-2520 and earlier of Analytics On-Prem and all versions of GMS before and including 9.3.1-SP2-Hotfix1.
Organizations that rely on vulnerable devices are recommended to upgrade to Analytics 22.214.171.124-2520-Hotfix1 and GMS 9.3.1-SP2-Hotfix-2.
“There is no workaround for this vulnerability,” said SonicWall. “However, the potential for exploits can be significantly reduced by including a Web Application Firewall (WAF) to block SQLi attempts.”