Vulnerability-Lookup

GHSA-RRP4-2XX3-MV29

Vulnerability from github – Published: 2022-02-01 00:47 – Updated: 2022-02-07 21:07

Summary

Command injection in gh-ost

Details

Gh-ost version <= 1.1.2 allows users to inject DSN strings via the -database parameter.

This is a low severity vulnerability as the attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server.

Impact

This issue may lead to arbitrary local file read.

Patches

Fixed in 1.1.3+.

Workarounds

None

References

https://advisory.dw1.io/51

For more information

If you have any questions or comments about this advisory: * Open an issue in github/gh-ost

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/github/gh-ost"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21687"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-31T20:45:59Z",
    "nvd_published_at": "2022-02-01T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Gh-ost version \u003c= 1.1.2 allows users to inject DSN strings via the `-database` parameter.\n\nThis is a low severity vulnerability as the attacker must have access to the target host or trick an administrator into executing a malicious `gh-ost` command on a host running `gh-ost`, plus network access from host running `gh-ost` to the attack\u0027s malicious MySQL server.\n\n### Impact\nThis issue may lead to arbitrary local file read.\n\n### Patches\nFixed in 1.1.3+.\n\n### Workarounds\nNone\n\n### References\n- https://advisory.dw1.io/51\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github/gh-ost](http://github.com/github/gh-ost)",
  "id": "GHSA-rrp4-2xx3-mv29",
  "modified": "2022-02-07T21:07:25Z",
  "published": "2022-02-01T00:47:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/github/gh-ost/security/advisories/GHSA-rrp4-2xx3-mv29"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21687"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/gh-ost/commit/a91ab042de013cfd8fbb633763438932d9080d8f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/github/gh-ost"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Command injection in gh-ost"
}

CVE-2022-21687 (GCVE-0-2022-21687)

Vulnerability from cvelistv5 – Published: 2022-02-01 11:56 – Updated: 2025-05-05 16:34

Title

Command injection in gh-ost

Summary

gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/github/gh-ost/security/advisor…	x_refsource_CONFIRM
https://github.com/github/gh-ost/commit/a91ab042d…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:46:39.432Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/github/gh-ost/security/advisories/GHSA-rrp4-2xx3-mv29"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/github/gh-ost/commit/a91ab042de013cfd8fbb633763438932d9080d8f"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21687",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-25T15:46:27.953611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T16:34:00.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack\u0027s malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-01T11:56:17.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/github/gh-ost/security/advisories/GHSA-rrp4-2xx3-mv29"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/github/gh-ost/commit/a91ab042de013cfd8fbb633763438932d9080d8f"
        }
      ],
      "source": {
        "advisory": "GHSA-rrp4-2xx3-mv29",
        "discovery": "UNKNOWN"
      },
      "title": "Command injection in gh-ost",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-21687",
          "STATE": "PUBLIC",
          "TITLE": "Command injection in gh-ost"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack\u0027s malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/github/gh-ost/security/advisories/GHSA-rrp4-2xx3-mv29",
              "refsource": "CONFIRM",
              "url": "https://github.com/github/gh-ost/security/advisories/GHSA-rrp4-2xx3-mv29"
            },
            {
              "name": "https://github.com/github/gh-ost/commit/a91ab042de013cfd8fbb633763438932d9080d8f",
              "refsource": "MISC",
              "url": "https://github.com/github/gh-ost/commit/a91ab042de013cfd8fbb633763438932d9080d8f"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-rrp4-2xx3-mv29",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-21687",
    "datePublished": "2022-02-01T11:56:17.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2025-05-05T16:34:00.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-RRP4-2XX3-MV29

Impact

Patches

Workarounds

References

For more information

CVE-2022-21687 (GCVE-0-2022-21687)

Tags

Sightings

Nomenclature