Is CVE-2022-23510 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-23510 being exploited in the wild.

How severe is CVE-2022-23510?

Low severity, with a CVSS score of 3.1, published 12 December 2022.

Which products and versions are affected?

@cubejs-backend/api-gateway (npm) SEMVER:introduced=0.31.23,fixed=0.31.24.

Is there a fix for CVE-2022-23510?

Yes. @cubejs-backend/api-gateway (npm): upgrade to 0.31.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-23510 attacked?

It is attacked over the network.

Am I affected by CVE-2022-23510?

Check whether you run @cubejs-backend/api-gateway (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-23510: Cube.js API Gateway row-level security bypass

CVE-2022-23510 · Severity: low · CVSS 3.1 · Published 2022-12-12

Cube.js is a data analytics platform that provides REST APIs for querying databases. A new SQL runner endpoint was introduced that allowed authenticated users to bypass row-level security restrictions and execute arbitrary SQL queries, potentially exposing sensitive data they should not have access to. The vulnerability affected only version 0.31.23 and was immediately patched in 0.31.24.

Technologies: @cubejs-backend/api-gateway (npm). Vendors: npm.

Quick answers

Is CVE-2022-23510 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-23510 being exploited in the wild.
How severe is CVE-2022-23510?: Low severity, with a CVSS score of 3.1, published 12 December 2022.
Which products and versions are affected?: @cubejs-backend/api-gateway (npm) SEMVER:introduced=0.31.23,fixed=0.31.24.
Is there a fix for CVE-2022-23510?: Yes. @cubejs-backend/api-gateway (npm): upgrade to 0.31.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-23510 attacked?: It is attacked over the network.
Am I affected by CVE-2022-23510?: Check whether you run @cubejs-backend/api-gateway (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@cubejs-backend/api-gateway (npm): upgrade to 0.31.24 or later
```
npm install @cubejs-backend/api-gateway@0.31.24
```

Technical details

The vulnerability is a security bypass in the /v1/sql-runner endpoint introduced in version 0.31.23. The endpoint was designed to bypass the modeling layer for Cube Cloud functionality but failed to enforce row-level security (RLS) checks that are normally applied through the modeling layer. Any authenticated user with a valid Cube JWT token could submit arbitrary SQL queries via this endpoint, circumventing RLS policies and accessing data they were not authorized to view. The attack requires valid authentication but no user interaction or elevated privileges. The issue was immediately reverted in version 0.31.24, making only version 0.31.23 vulnerable.

Affected products

Cube API Gateway 0.31.23

Identifiers

CVE-2022-23510
GHSA-6jqm-3c9g-pch7

Timeline

2022-12-09: disclosed: CVE published on NVD
2022-12-12: patched: Version 0.31.24 released with complete revert of the vulnerable endpoint

References

https://github.com/cube-js/cube.js/security/advisories/GHSA-6jqm-3c9g-pch7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.