Critical · published September 8, 2022
🔥 A crafty exploit allows users with `READ` permissions to inject malicious AQL queries into your ArangoDB through cruddl's `@flexSearchFulltext`. Think of it like a restaurant that lets customers modify their meal orders without checking — one mischievous diner could sneak in a recipe that causes chaos in the kitchen! An attacker could inject arbitrary queries, potentially exposing sensitive data or wreaking havoc in your database. This leaves your system wide open to manipulation, making it a playground for malicious actors. It's an absolutely devastating scenario if not addressed!
Think of it like a restaurant that lets customers modify their meal orders without checking — one mischievous diner could sneak in a recipe that causes chaos in the kitchen! This vulnerability in cruddl, affecting versions 1.1.0 to 2.7.0 and 3.0.2, allows users with `READ` permission on certain entities to exploit the `@flexSearchFulltext` feature, enabling them to execute arbitrary queries on the underlying ArangoDB.
An attacker could inject arbitrary queries, potentially exposing sensitive data or wreaking havoc in your database. This leaves your system wide open to manipulation, making it a playground for malicious actors. It's an absolutely devastating scenario if not addressed! To fix this, immediately update cruddl to version 2.7.0 or 3.0.2. If you can't patch right away, consider temporarily removing `@flexSearchFulltext` from your schemas to mitigate the risk. Don't wait — act now to protect your data! You’ve got this! With these steps, you’ll be a security hero in no time! 🛡️