Impact
If a vunerable version of cruddl is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB.
Schemas that do not use @flexSearchFulltext are not affected.
The attacker needs to have READ permission to at least one root entity type that has @flexSearchFulltext enabled.
Patches
The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl.
Workarounds
Users can temporarily remove @flexSearchFulltext from their schemas before they can update cruddl.
For more information
If you have any questions or comments about this advisory:
Impact
If a vunerable version of cruddl is used to generate a schema that uses
@flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB.Schemas that do not use
@flexSearchFulltextare not affected.The attacker needs to have
READpermission to at least one root entity type that has@flexSearchFulltextenabled.Patches
The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl.
Workarounds
Users can temporarily remove
@flexSearchFulltextfrom their schemas before they can update cruddl.For more information
If you have any questions or comments about this advisory: