Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-36084

CVE-2022-36084: cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch

10

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-36084
GHSA ID
GHSA-qm4w-4995-vg7f
EPSS Score
0.75858%
CWE
CWE-74
Published
9/16/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
cruddlnpm>= 3.0.0, < 3.0.23.0.2
cruddlnpm>= 1.1.0, < 2.7.02.7.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper AQL query construction in generateTokenizationQuery. The commit diff shows the function was modified from unsafe string interpolation (TOKENS("${value.expression}", ...)) to parameterized aql-tagged templates. This matches the CWE-74 injection pattern described in the advisory, where user-controlled inputs were not neutralized before being used in downstream AQL queries. The arangodb-adapter.ts changes demonstrate the transition from raw query execution to using parameterized boundValues, confirming the injection vector was in query generation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t I* * vun*r**l* v*rsion o* *ru**l is us** to **n*r*t* * s***m* t**t us*s `@*l*xS**r***ullt*xt`, us*rs o* t**t s***m* m*y ** **l* to inj**t *r*itr*ry *QL qu*ri*s t**t will ** *orw*r*** to *n* *x**ut** *y *r*n*o**. S***m*s t**t *o not us* `

Reasoning

T** vuln*r**ility st*ms *rom improp*r *QL qu*ry *onstru*tion in **n*r*t*Tok*niz*tionQu*ry. T** *ommit *i** s*ows t** *un*tion w*s mo*i*i** *rom uns*** strin* int*rpol*tion (`TOK*NS("${v*lu*.*xpr*ssion}", ...)`) to p*r*m*t*riz** *ql-t***** t*mpl*t*s.