CVE-2023-46575 (Go, published 2023-11-24T14:15Z)
Description: value: A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/meshery/meshery
Files changed:
server/handlers/database_handlers.go
server/models/meshery_application_persister.go
server/models/meshery_filter_persister.go
server/models/meshery_k8scontext_persister.go
server/models/meshery_pattern_persister.go
server/models/pattern_resource_persister.go
server/models/performance_profile_persister.go
server/models/sql-utils.go
Commit message: ## Add "order by" parameter filter

## and export SanitizeOrderInput function

Signed-off-by: phant0ms <ph1nt0ms@gmail.com>


Vulnerable code:
	order = sanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = sanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = sanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = sanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = sanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = sanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = sanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	SELECT 
	order = sanitizeOrderInput(order, []string{"updated_at", "created_at", "name", "last_run"})
// sanitizeOrderInput takes in the "order by" query, a validColums
// sanitizeOrderInput also expects the query to be no longer than two words, that is
func sanitizeOrderInput(order string, validColumns []string) string {

Fixed code:
	order = models.SanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = SanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = SanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = SanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = SanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = SanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = SanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	order = SanitizeOrderInput(order, []string{"created_at", "updated_at", "name"})
	SELECT
	order = SanitizeOrderInput(order, []string{"updated_at", "created_at", "name", "last_run"})
// SanitizeOrderInput takes in the "order by" query, a validColums
// SanitizeOrderInput also expects the query to be no longer than two words, that is
func SanitizeOrderInput(order string, validColumns []string) string {