Listen to this Post
The vulnerability exists within the `parsl.monitoring.visualization.views.py` module of the Parsl library. User-supplied `workflow_id` parameters are taken directly from URL routes and concatenated into raw SQL query strings using Python’s unsafe `%` operator for string formatting, without any sanitization or parameterization. This occurs in multiple view functions handling dashboard endpoints like /workflow/<workflow_id>/dag_group_by_states. An attacker can inject SQL meta-characters (like single quotes) into the `workflow_id` value in the HTTP request. When the server builds the SQL command, the injected payload becomes part of the executed query syntax. This allows for boolean-based blind, time-based, and union-based SQL injection attacks against the underlying monitoring database (typically SQLite), enabling unauthorized data access or system disruption.
Platform: Parsl
Version: Multiple
Vulnerability : SQL Injection
Severity: High
date: Undisclosed
Prediction: Patch pending
What Undercode Say:
pip install 'parsl[monitoring,visualization]' parsl-visualize --port 8080 curl "http://localhost:8080/workflow/VALID_ID'%20AND%20'1'='0/dag_group_by_states" curl "http://localhost:8080/workflow/VALID_ID'%20AND%20'1'='1/dag_group_by_states"
How Exploit:
Inject workflow_id parameter. Boolean-based blind SQLi. Use UNION queries. Exfiltrate database contents.
Protection from this CVE
Use parameterized queries. Implement input validation. Apply SQL escaping.
Impact:
[bash]
Data exfiltration possible.
Access control bypass.
Denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
