cbcvebase.
CVE-2021-31856
published 2021-04-28

CVE-2021-31856: A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles…

PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
75.38%
99.5th percentile
A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).

Affected

1 ranges
VendorProductVersion rangeFixed in
layer5meshery——

Detection & IOCsextracted from sources · hover to see the quote

url/api/experimental/patternfile?order=id%3Bselect(md5({{num}}))&page=0&page_size=0↗
path/api/experimental/patternfile↗
  • →Detect SQL injection attempts against the Meshery pattern files endpoint by monitoring GET requests to /api/experimental/patternfile with an `order` parameter containing SQL metacharacters (e.g., semicolons, SQL function calls such as `select`, `md5`). ↗
  • →A successful blind/time-based or error-based SQL injection probe can be confirmed by checking if the HTTP 200 response body contains the MD5 hash of a known injected numeric value, indicating arbitrary SQL execution. ↗
  • →The vulnerable code path is in `GetMesheryPatterns` within `models/meshery_pattern_persister.go`; focus code review and runtime monitoring on unsanitized use of the `order` query parameter in SQL queries. ↗
  • ·The vulnerability is unauthenticated (PR:N) and network-reachable (AV:N), meaning no credentials are required to exploit the SQL injection via the REST API endpoint. ↗
  • ·The Nuclei template uses a numeric canary value (`num: "999999999"`) injected via `select(md5(...))` to confirm exploitation; defenders should tune WAF/IDS rules to catch URL-encoded semicolons (`%3B`) followed by SQL function calls in the `order` parameter. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.