4 ms·
Much better - and default config is a denial of service impact issue (not remote code or replay).
by anon102010 7y ago
Much better - and default config is a denial of service impact issue (not remote code or replay).
- tptacek 7y agoI'm not sure I trust the "it's SQL injection but you can only use it to stuff bad records into the database" summary here. SQL is usually an easy thing to pivot from.
- dasyatidprime 7y agoThe way I read the advisory is: (1) The most harmful vulnerability represented anywhere in this advisory is SQL injection. (2) The sync endpoint allows a full SQL injection, but the sync endpoint is normally IP-restricted and has an empty allow list in the default configuration, which can mitigate the exposure. (3) The verify endpoint does not allow a full SQL injection, but allows overly long values to be passed through to SQL. The first paragraph in “Technical details” mixes (1) and (3) confusingly, and should have had a paragraph break before the sentence beginning “Verify” (or been rewritten). A quick glance at the patchset suggests this is right (the verification code looks to have been made stricter in the verify endpoint, but added in the sync endpoint), but I didn't dig deeper than that. [edited slightly for wording]
- tptacek 7y agoThanks! This is super helpful.