CVE-2023-47460: SQL Injection Vulnerability in Knovos Discovery v.22.67.0

Overview

A high severity vulnerability has been identified in Knovos Discovery v.22.67.0, a widely used enterprise software solution. Designated as CVE-2023-47460, this security flaw allows a remote attacker to execute arbitrary code via an SQL injection attack. This type of vulnerability is particularly concerning due to the potential for system compromise or data leakage, which can lead to significant organizational disruption, financial burden, and reputational damage.
The vulnerability is relevant to all organizations utilizing the affected version of Knovos Discovery, and its criticality is underscored by a CVSS severity score of 8.8. The potential for remote code execution places a significant amount of power in the hands of potential attackers, making immediate mitigation actions paramount.

Vulnerability Summary

CVE ID: CVE-2023-47460
Severity: High, CVSS score 8.8
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise, potential data leakage

Affected Products

Product | Affected Versions

Knovos Discovery | v.22.67.0

How the Exploit Works

The exploit takes advantage of an SQL injection vulnerability within the /DiscoveryProcess/Service/Admin.svc/getGridColumnStructure component of the Knovos Discovery software. A remote attacker can send specially crafted SQL commands which the software inadvertently processes. This allows the attacker to manipulate the software’s database, potentially leading to unauthorized access, data manipulation, or even system compromise.

Conceptual Example Code

Below is a conceptual example of how the vulnerability might be exploited. This is a hypothetical SQL Injection attack using a malicious payload in an HTTP request.

POST /DiscoveryProcess/Service/Admin.svc/getGridColumnStructure HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "columnStructure": "'; DROP TABLE users; --" }

In this example, the “columnStructure” parameter is manipulated to include a SQL statement that would force the server to drop or delete the “users” table. This is a simple example and real-world attacks might involve more complex payloads aimed at data exfiltration or system compromise.