7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-h8cj-hpmg-636v

GHSA-h8cj-hpmg-636v: appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution

Summary

A SQL injection vulnerability exists in FilterDataServiceCE.java where the dropTable method constructs a SQL DROP TABLE statement using string concatenation with the table name. If the table name is derived from user input, this allows for arbitrary SQL command execution.

Details

The vulnerability is located in app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java.

Line 627 in dropTable method:

public void dropTable(String tableName) {
    String dropTableQuery = "DROP TABLE " + tableName + ";";
    executeDbQuery(dropTableQuery);
}

The tableName argument is concatenated directly into the SQL string without validation or escaping.

PoC

If dropTable is exposed to user input (e.g., via a utility API that accepts a table name to clean up), an attacker could provide a value like: valid_table; DROP TABLE users; --

The resulting query would be: DROP TABLE valid_table; DROP TABLE users; --;

This would delete the intended table and then delete the users table (or execute any other injected SQL).

Impact

Type: SQL Injection
Impact: Data Loss (Drop Table), potentially Data Exfiltration or Modification depending on database permissions.
Who is impacted: Appsmith server instances.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-h8cj-hpmg-636v

GHSA-h8cj-hpmg-636v:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.appsmith:interfaces	maven	<= 1.98	1.99

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the FilterDataServiceCE.java file within the dropTable method. According to the provided description and the commit patch, this method was constructing a raw SQL DROP TABLE statement by concatenating an unvalidated tableName string. This allows for SQL injection. The patch introduces a validation method, validateFilterTempTableName, which uses a regular expression to ensure the table name conforms to an expected format before being used in the query. The vulnerable function is clearly com.appsmith.external.services.ce.FilterDataServiceCE.dropTable as it directly handles the unsanitized input and constructs the malicious query.

Vulnerable functions

com.appsmith.external.services.ce.FilterDataServiceCE.dropTable

app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java

The `dropTable` method is vulnerable to SQL injection. It constructs a `DROP TABLE` SQL query by directly concatenating the `tableName` parameter without any validation or sanitization. An attacker could provide a malicious string like `valid_table; DROP TABLE users; --` to execute arbitrary SQL commands, leading to data loss or other unauthorized database modifications.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.