CVE-2022-36084
Description
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas.
How to fix
- aeb cruddl2.7.0, 3.0.2 or later
- cruddl3.0.2, 2.7.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| aeb cruddl | 1.1.0 ≤ v < 2.7.0, 3.0.0 ≤ v < 3.0.2 | 2.7.0, 3.0.2 |
| cruddlnpm | 3.0.0 ≤ v < 3.0.2, 1.1.0 ≤ v < 2.7.0 | 3.0.2, 2.7.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.