Description
Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's COPY FROM PROGRAM functionality.
Problem types
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Product status
Credits
Dolev Farhi
References
www.exploit-db.com/exploits/49802 (ExploitDB-49802)
github.com/hasura/graphql-engine (Hasura GraphQL Engine GitHub Repository)
www.vulncheck.com/...es/hasura-graphql-remote-code-execution (VulnCheck Advisory: Hasura GraphQL 1.3.3 - Remote Code Execution)