CVE-2020-13921

published 2020-08-05

CVE-2020-13921: **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

Priority P2 65 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
apache	skywalking	—	—
apache	skywalking	—	—
apache	skywalking	—	—
apache	skywalking	—	—
apache	skywalking	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /graphql

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Apache SkyWalking GraphQL SQL Injection Inbound (CVE-2020-13921)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/graphql"; fast_pattern; http.request_body; content:"|7b 22|query"; nocase; startswith; content:"|27 29|'"; pcre:"/^\s?.{0,100}(?:SELECT|UNION|CHAR|LONGVARCHAR|SCHEMA|FROM|WHERE|IFNULL|INSERT|UPDATE)/R"; reference:url,blog.csdn.net/caiqiiqi/article/details/107857173; reference:cve,2020-13921; classtype:attempted-admin; sid:2033403; rev:2;)

bytes

|7b 22|query

bytes

|27 29|

• → Attack arrives as an HTTP POST request to the /graphql endpoint; detect by matching POST method combined with the /graphql URI path.
• → Request body begins with the bytes 7B 22 ('"{ "') followed by the word 'query' (case-insensitive), indicating a GraphQL query payload used to deliver the injection.
• → The SQL injection payload contains the byte sequence 27 29 (i.e., "') ") — a single-quote followed by a closing parenthesis — used to break out of the SQL wildcard query context.
• → After the quote/paren escape sequence, the payload contains classic SQL injection keywords; PCRE match for SELECT, UNION, CHAR, LONGVARCHAR, SCHEMA, FROM, WHERE, IFNULL, INSERT, or UPDATE within 100 characters.
• → Vulnerability is only exploitable when H2, MySQL, or TiDB is configured as the Apache SkyWalking storage backend; scope detection/patching efforts accordingly. ↗
• → MITRE ATT&CK mapping: TA0001 Initial Access / T1190 Exploit Public-Facing Application — prioritize perimeter detection on internet-exposed SkyWalking instances.

• · The SQL injection is only present when H2, MySQL, or TiDB is used as the storage backend. Elasticsearch-backed deployments are NOT affected and do not require the same detection priority. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89