Critical · published December 9, 2022
🚨 A single endpoint allows all authenticated Cube clients to run any SQL query, bypassing row-level security entirely! 🔥 Think of it like a restaurant where everyone at the table can access the private kitchen, making it possible for anyone to steal recipes or change orders without restriction. How chaotic would that be? An attacker could execute arbitrary SQL commands, potentially accessing, modifying, or deleting sensitive data across the entire database. This is no small oversight; it's a wide-open door to devastating data breaches and unauthorized actions that could cripple your business operations!
Think of it like a restaurant where everyone at the table can access the private kitchen, making it possible for anyone to steal recipes or change orders without restriction. How chaotic would that be? This vulnerability in Cube.js version 0.31.23 arises from the /v1/sql-runner endpoint which neglects to enforce SQL row-level security, allowing authenticated users to execute any SQL query they desire.
An attacker could execute arbitrary SQL commands, potentially accessing, modifying, or deleting sensitive data across the entire database. This is no small oversight; it's a wide-open door to devastating data breaches and unauthorized actions that could cripple your business operations! Upgrade immediately to Cube.js version 0.31.24 to patch this critical vulnerability. Alternatively, if upgrading isn't feasible, downgrade to version 0.31.22 until you can apply the fix. Ensure your teams are aware, as there are no workarounds! You’ve got this! Follow these steps, and you’ll have your security fortress back in no time! 🛡️