Executive brief
a12nserver is an OAuth2 authorization server used to manage user access tokens and authentication. When using MySQL databases, a SQL injection vulnerability in the Knex query builder (a dependency) could allow an attacker with administrative privileges to extract OAuth2 access tokens for arbitrary users, potentially granting unauthorized access to integrated applications and sensitive user data.
Technical details
This vulnerability is a SQL injection (CWE-89) in the Knex query builder library that affects a12nserver when used with MySQL databases. The root cause stems from improper neutralization of special SQL characters in user-controllable inputs, allowing attackers to inject arbitrary SQL commands. An attacker requires high-level privileges (administrative access) to exploit this vulnerability, with no user interaction required and network-based attack capability. A successful exploit enables attackers to read sensitive data including OAuth2 access tokens for unauthorized users, potentially granting access to resources belonging to other user accounts. The vulnerability was patched by updating Knex to version 2.4.0 in a12nserver 0.23.0.
Affected products
- Curveball a12nserver 0.20.0 to <0.23.0
- Knex Knex <2.4.0
Timeline
- 2023-01-13: disclosed
- 2023-01-13: patched: a12nserver 0.23.0 released with Knex 2.4.0