SQL Injection Vulnerability in api /api/v1/containers

[xiaozhicai]

api : /api/v1/containers
Is vulnerable to SQL injection, by the parameter ‘orderby’ in url.


As the pictures above shows,
orderby=title;%20SELECT%20PG_SLEEP(2)%20-- , it took 2 seconds to receive the response from server
orderby=title;%20SELECT%20PG_SLEEP(5)%20-- , it took 5 seconds to receive the response from server

Then I read through the code that I download from github(version 5.3.6.1), I found that the parameter will form SQL without sterilization (yeah, you have designed SQLUtil.sanitizeSortBy to prevent SQL injection, but in this case, the vulnerable API didn't call SQLUtil.sanitizeSortBy）

I tried to attack the project by sqlmap(a tool to detect and exploit SQL injection), and here is the result that sqlmap gave me:
tables that the project contains:

columns that the table called ‘adminconfig’ contains:

It’s obviously that there is SQL injection in your program.

[wezell]

Note to QA:

• test creating templates, layouts, pages
• test searching for templates, containers (from a page, from the portlets, from the layout editor)
• test host copy

[dsilvam]

Passed Internal QA: sortOrder param getting sanitized and functionality above working as expected.

[bryanboza]

Fixed, tested on release-20.10.1 // Postgres // FF