SQL injection in Cyrus SASL - CVE-2022-24407

Vulnerability identifier: #VU60842

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2022-24407

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Cyrus SASL
Amazon Linux AMI
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)
Red Hat Enterprise Linux for IBM z Systems
CentOS
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Anolis OS
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Linux Enterprise Server
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
Oracle Solaris
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Module for Basesystem
openEuler
Fedora
Red Hat OpenShift Serverless
Harbor
Red Hat Virtualization
OpenShift Virtualization
Red Hat OpenShift GitOps
IBM QRadar Network Security
Service Telemetry Framework
Ansible Automation Platform
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Security Access Manager for Enterprise Single-Sign On
IBM Robotic Process Automation
Oracle Communications Cloud Native Core Binding Support Function
Session Smart Router
Red Hat OpenStack
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
IBM Edge Application Manager
Traffix SDC
cyrus-sasl2 (Debian package)
cyrus-sasl (Red Hat package)
redhat-release-virtualization-host (Red Hat package)
redhat-virtualization-host (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
cyrus-sasl-sqlauxprop-32bit
cyrus-sasl-digestmd5
cyrus-sasl-openssl1
cyrus-sasl-openssl1-crammd5
cyrus-sasl-openssl1-digestmd5
cyrus-sasl-openssl1-gssapi
cyrus-sasl-openssl1-ntlm
cyrus-sasl-openssl1-otp
cyrus-sasl-openssl1-plain
cyrus-sasl-openssl1-32bit
cyrus-sasl-openssl1-crammd5-32bit
cyrus-sasl-openssl1-digestmd5-32bit
cyrus-sasl
cyrus-sasl-crammd5
cyrus-sasl-openssl1-crammd5-x86
cyrus-sasl-gssapi
cyrus-sasl-otp
cyrus-sasl-plain
cyrus-sasl-saslauthd
cyrus-sasl-sqlauxprop
cyrus-sasl-32bit
cyrus-sasl-crammd5-32bit
cyrus-sasl-digestmd5-32bit
cyrus-sasl-gssapi-32bit
cyrus-sasl-otp-32bit
cyrus-sasl-plain-32bit
cyrus-sasl-debuginfo
cyrus-sasl-openssl1-debuginfo-32bit
cyrus-sasl-openssl1-debugsource
cyrus-sasl-openssl1-debuginfo
cyrus-sasl-debuginfo-32bit
cyrus-sasl-openssl1-gssapi-32bit
cyrus-sasl-saslauthd-debugsource
cyrus-sasl-saslauthd-debuginfo
cyrus-sasl-debugsource
cyrus-sasl-openssl1-x86
cyrus-sasl-openssl1-plain-x86
cyrus-sasl-openssl1-otp-x86
cyrus-sasl-openssl1-gssapi-x86
cyrus-sasl-openssl1-digestmd5-x86
cyrus-sasl-openssl1-plain-32bit
cyrus-sasl-openssl1-otp-32bit
libsasl2-modules-sql (Ubuntu package)
cyrus-sasl-digestmd5-debuginfo
cyrus-sasl-crammd5-debuginfo
cyrus-sasl-devel
cyrus-sasl-gssapi-debuginfo
libsasl2-3-32bit-debuginfo
libsasl2-3-32bit
cyrus-sasl-plain-32bit-debuginfo
cyrus-sasl-gssapi-32bit-debuginfo
cyrus-sasl-digestmd5-32bit-debuginfo
cyrus-sasl-crammd5-32bit-debuginfo
cyrus-sasl-32bit-debuginfo
libsasl2-3-debuginfo
cyrus-sasl-otp-debuginfo
cyrus-sasl-plain-debuginfo
cyrus-sasl-sqlauxprop-debuginfo
libsasl2-3
cyrus-sasl-gssapi-debuginfo-32bit
cyrus-sasl-otp-debuginfo-32bit
cyrus-sasl-plain-debuginfo-32bit
libsasl2-3-debuginfo-32bit
cyrus-sasl-crammd5-debuginfo-32bit
cyrus-sasl-sqlauxprop-debuginfo-32bit
cyrus-sasl-digestmd5-debuginfo-32bit
cyrus-sasl-sql
cyrus-sasl-scram
cyrus-sasl-ntlm
cyrus-sasl-md5
cyrus-sasl-lib
cyrus-sasl-ldap
cyrus-sasl-gs2
cyrus-sasl-help
cyrus-sasl-bdb-digestmd5-debuginfo
cyrus-sasl-bdb-plain-debuginfo
cyrus-sasl-bdb-plain
cyrus-sasl-bdb-otp-debuginfo
cyrus-sasl-bdb-otp
cyrus-sasl-bdb-ntlm-debuginfo
cyrus-sasl-bdb-ntlm
cyrus-sasl-bdb-gssapi-debuginfo
cyrus-sasl-bdb-gssapi
cyrus-sasl-bdb-gs2-debuginfo
cyrus-sasl-bdb-gs2
cyrus-sasl-bdb-digestmd5
cyrus-sasl-bdb
cyrus-sasl-bdb-devel
cyrus-sasl-bdb-debugsource
cyrus-sasl-bdb-debuginfo
cyrus-sasl-sqlauxprop-bdb-debuginfo
cyrus-sasl-sqlauxprop-bdb
cyrus-sasl-bdb-scram
cyrus-sasl-saslauthd-bdb-debugsource
cyrus-sasl-saslauthd-bdb-debuginfo
cyrus-sasl-saslauthd-bdb
cyrus-sasl-bdb-scram-debuginfo
redhat-virtualization-host-productimg (Red Hat package)
Red Hat Virtualization Host
Dell Policy Manager for Secure Connect Gateway (SCG)
EMC ECS
XtremIO X2
IBM Qradar SIEM
MySQL Connectors
Zimbra Collaboration
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Juniper Junos Space

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of password in the SQL plugin shipped with Cyrus SASL. A remote non-authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Install updates from vendor's website.

• https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28