Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability

Vulnerability

Description CVE-2023-30867 is a SQL injection vulnerability in Apache StreamPark, a streaming application development framework. The flaw occurs when users perform name-based fuzzy searches (e.g., for job names or role names) on certain pages. The application constructs SQL queries by directly concatenating user input into LIKE clauses, such as select * from table where jobName like '%jobName%'. The jobName field is not properly sanitized, allowing attackers to inject arbitrary SQL commands [1].

Attack

Vector Exploitation requires an authenticated user to send crafted input to the vulnerable search feature. The attacker must be logged in and have access to the fuzzy search functionality. By inserting SQL meta-characters (e.g., single quotes, UNION statements) into the search term, an attacker can manipulate the query beyond its intended scope. No special network position is required beyond normal access to the platform [1].

Impact

Successful SQL injection can lead to information leakage. An attacker may extract sensitive data from the database, including user credentials, application configurations, or other stored information. The vulnerability does not directly enable remote code execution, but the data exposure can compromise confidentiality and serve as a stepping stone for further attacks [1].

Mitigation

The issue is fixed in Apache StreamPark version 2.1.2. Users are strongly advised to upgrade to this version or later. No workarounds are documented. As of the publication date, there is no evidence of active exploitation in the wild, but patching is recommended to prevent potential data breaches [1].