6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-40120

CVE-2024-40120: SeaweedFS Vulnerable to SQL Injection

seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-40120

CVE-2024-40120:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/seaweedfs/seaweedfs	go	< 0.0.0-20240625155419-9ac102336200	0.0.0-20240625155419-9ac102336200

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is described as a SQL injection in /abstract_sql/abstract_sql_store.go. The provided commit 9ac1023362000f6e8e58c9d278653f5926a0d90e modifies this file. The key changes are in the getTxOrDB function and the introduction of the isValidBucket helper function, which now uses s3bucket.VerifyS3BucketName for stricter bucket name validation. The patch adds an explicit error return in getTxOrDB if isValidBucket(bucket) (which now includes the stricter S3 bucket name verification) returns false. This implies that prior to this change, an invalid bucket name (potentially crafted for SQL injection) could pass this initial check and be used in subsequent database operations, leading to the vulnerability. The function getTxOrDB is responsible for obtaining a database transaction or connection and determining the bucket, making it a critical point for input validation related to bucket names used in SQL queries. The vulnerability lies in the insufficient validation of the bucket parameter within getTxOrDB before it's used in a context where SQL injection is possible.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.