CVE-2024-22196: Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

(updated )

The OrderAndPaginate function is used to order and paginate data. It is defined as follows:

func OrderAndPaginate(c *gin.Context) func(db *gorm.DB) *gorm.DB {
return func(db *gorm.DB) *gorm.DB {
sort := c.DefaultQuery("order", "desc")

order := fmt.Sprintf("`%s` %s", DefaultQuery(c, "sort_by", "id"), sort)
db = db.Order(order)

...
}
}

By using DefaultQuery, the "desc" and "id" values are used as default values if the query parameters are not set. Thus, the order and sort_by query parameter are user-controlled and are being appended to the order variable without any sanitization. The same happens with SortOrder, but it doesn’t seem to be used anywhere.

func SortOrder(c *gin.Context) func(db *gorm.DB) *gorm.DB {
return func(db *gorm.DB) *gorm.DB {
sort := c.DefaultQuery("order", "desc")
order := fmt.Sprintf("`%s` %s", DefaultQuery(c, "sort_by", "id"), sort)
return db.Order(order)
}
}

This issue was found using CodeQL for Go: Database query built from user-controlled sources.

References

Code Behaviors & Features

Detect and mitigate CVE-2024-22196 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →