Executive brief
Corteza, an open-source low-code platform, contains a security flaw in how it handles database queries when using Microsoft SQL Server. An attacker with basic user permissions can exploit this to run unauthorized database commands, potentially leading to the theft of sensitive business data or unauthorized modifications. This occurs specifically when users filter records using the 'meta' field.
Technical details
A SQL injection vulnerability exists in Corteza version 2024.9.8 when configured with a Microsoft SQL Server (MSSQL) backend. The flaw is rooted in incorrect T-SQL string escaping during the processing of JSON-path meta filters within the Compose module. An authenticated attacker with low privileges can provide specially crafted input to the 'meta' field filter to bypass intended query logic. This allows for the execution of arbitrary SQL commands, which can result in unauthorized data retrieval (High confidentiality impact) and limited data modification (Low integrity impact). The vulnerability is reachable over the network and requires valid user credentials.
Affected products
- Corteza Project Corteza 2024.9.8
Timeline
- 2026-05-11: disclosed: Initial disclosure by Fluid Attacks
- 2026-05-11: advisory: CVE-2026-6093 published