A critical SQL Injection vulnerability, known as CVE-2022-45930, has been discovered in the AAA (Authentication, Authorization, and Accounting) component of OpenDaylight (ODL) before .16.5. This security flaw is due to improper validation and sanitation of user-supplied input, which can potentially enable a remote attacker to execute arbitrary SQL commands in the context of the privileged database user.

In this post, we'll explore the details of the vulnerability, including a look at the vulnerable code, and steps to reproduce the exploit. We'll also discuss mitigation strategies and provide links to the original references.

The vulnerability is found in the DomainStore.java file of the aaa-idm-store-h2 module

aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/DomainStore.java

The affected method is the deleteDomain function, which can be triggered via the auth/v1/domains/ API interface:

// Vulnerable code in DomainStore.java
public int deleteDomain(String name) {
    try (final Connection conn = DriverManager.getConnection(CONN_URL);
         final PreparedStatement stmt = conn.prepareStatement(DELETE_DOMAIN)) {
        stmt.setString(1, name);
        final int rv = stmt.executeUpdate();
        conn.commit();
        return rv;
    } catch (final SQLException e) {
        LOG.error("Error attempting to delete domain", e);
        return ;
    }
}

Exploit Details

The SQL Injection vulnerability arises from the lack of proper input validation and sanitation in the deleteDomain function. The name parameter, which is supplied by the user, is not properly sanitized before being passed to the PreparedStatement. Consequently, a malicious user can manipulate the input in such a way as to modify the underlying SQL query executed by the method.

To exploit this vulnerability, an attacker would need to craft a specially crafted API request targeting the /auth/v1/domains/ API interface to inject malicious SQL commands:

DELETE /auth/v1/domains/{malicious_input_here}

By manipulating the {malicious_input_here}, the attacker can potentially exfiltrate sensitive information, alter the database content, or even execute arbitrary OS commands in the context of the database user.

Mitigation Strategies

The immediate solution to addressing this vulnerability is to upgrade to OpenDaylight version .16.5, which already contains the necessary patches. It is important for system administrators to prioritize updating their ODL deployments to the latest secure version to avoid the potential risks posed by this vulnerability.

Additionally, developers should implement proper input validation and sanitation mechanisms for all user-supplied inputs and employ prepared statements with appropriate parameter binding to prevent SQL Injection attacks.

Original References

Further details about the CVE-2022-45930 vulnerability can be found in the NIST National Vulnerability Database (NVD):

- NVD CVE-2022-45930 Entry

- OpenDaylight Security Advisory

Conclusion

The CVE-2022-45930 vulnerability presents a serious security risk to affected OpenDaylight deployments. By understanding the vulnerability, administrators can take appropriate steps to mitigate the risks and ensure the secure operation of their ODL instances. This post provided an in-depth look into the vulnerability, its exploit details, and available mitigation strategies. Stay up-to-date with the latest security patches and best practices to shield your systems from such vulnerabilities.

Timeline

Published on: 11/27/2022 03:15:00 UTC
Last modified on: 11/30/2022 20:47:00 UTC