New Relic .NET Agent contains SQL Injection
Date: 2022-05
Affected: nuget/NewRelic.Agent
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2017-9246
CWE: CWE-89
CVSS: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLAN_ALL ON protection mechanism.


Mitigations:

Architectural layers (MAESTRO):