CVE-2024-40120

Vulnerability

Overview

SeaweedFS versions prior to 3.69 are vulnerable to a SQL injection flaw (CWE-89) in the Filer server component. The vulnerability resides in the file weed/filer/abstract_sql/abstract_sql_store.go, where user-controlled input, specifically the bucket name parameter, is unsafely concatenated into SQL statements using fmt.Sprintf without proper sanitization or parameterization [2], [3]. This affects all SQL generation methods, including GetSqlFind, GetSqlListExclusive, GetSqlCreateTable, GetSqlDelete, and GetSqlDropTable [2], [3].

Exploitation and

Attack Surface

An attacker can exploit this vulnerability by crafting malicious bucket names that inject arbitrary SQL commands into queries executed against the MySQL metadata database. The Filer server must be configured with MySQL as the file metadata store (filer.toml with the mysql2 section enabled) for this attack to be feasible [2], [3]. The vulnerability does not require authentication if the Filer endpoint is exposed, but typical deployments may require prior access or the ability to create buckets [1], [2].

Impact

Successful exploitation can lead to severe consequences. A SELECT injection allows an attacker to read, modify, or exfiltrate sensitive metadata stored in the database, potentially retrieving file names, directory structures, and other stored information. Operations such as DROP, CREATE, and DELETE could be used to destroy or alter the metadata tables, leading to data loss or denial of service [2], [3]. The impact is most critical for SELECT injection, as it can enable broader data breaches.

Mitigation

Status

The vulnerability has been addressed in SeaweedFS version 3.69, released after the disclosure. It is recommended that all users upgrade to version 3.69 or later [2]. Administrators should also ensure their Filer server is not directly exposed to untrusted networks, and use input validation or prepared statements to prevent similar injection attacks in the future. No other workarounds are listed in the advisories [1], [2], [3], [4].