OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
opensearch-project:sql
References 7
https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4q…
https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4
https://github.com/opensearch-project/sql/pull/5469
https://github.com/opensearch-project/sql/pull/5469
https://github.com/opensearch-project/sql/pull/5572
https://github.com/opensearch-project/sql/pull/5572
https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860a…
https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de
https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6…
https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db
https://github.com/opensearch-project/sql/releases/tag/2.19.6.0
https://github.com/opensearch-project/sql/releases/tag/2.19.6.0
https://github.com/opensearch-project/sql/releases/tag/3.7.0.0
https://github.com/opensearch-project/sql/releases/tag/3.7.0.0