Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| decidim-admin | rubygems | < 0.30.9 | 0.30.9 |
| decidim-admin | rubygems | >= 0.31.0.rc1, < 0.31.5 | 0.31.5 |
| decidim-admin | rubygems | >= 0.32.0.rc1, < 0.32.0 | 0.32.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a time-based blind SQL injection within the admin user search functionality of Decidim. The root cause is the direct interpolation of user-provided search terms (params[:term]) into a raw SQL ORDER BY clause within the search method of the Decidim::Admin::OrganizationController. The Arel.sql and sanitize_sql_array methods were used incorrectly, as the string interpolation occurred before sanitization, rendering it ineffective.
The users action in the same controller served as the entry point for this vulnerable functionality. An authenticated admin could craft a search term that included malicious SQL, which would then be executed by the database. The patch addresses this vulnerability by completely removing the vulnerable users and search methods and the corresponding route. The functionality was refactored to use a safer GraphQL API endpoint for user searches, thus eliminating the insecure code path.
Decidim::Admin::OrganizationController#usersdecidim-admin/app/controllers/decidim/admin/organization_controller.rb
Decidim::Admin::OrganizationController#searchdecidim-admin/app/controllers/decidim/admin/organization_controller.rb