CVE-2024-22196: Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

(updated )

The OrderAndPaginate function is used to order and paginate data. It is defined as follows:

func OrderAndPaginate(c *gin.Context) func(db *gorm.DB) *gorm.DB {
return func(db *gorm.DB) *gorm.DB {
sort := c.DefaultQuery("order", "desc")

order := fmt.Sprintf("`%s` %s", DefaultQuery(c, "sort_by", "id"), sort)
db = db.Order(order)

...
}
}

By using DefaultQuery, the "desc" and "id" values are used as default values if the query parameters are not set. Thus, the order and sort_by query parameter are user-controlled and are being appended to the order variable without any sanitization. The same happens with SortOrder, but it doesn’t seem to be used anywhere.

func SortOrder(c *gin.Context) func(db *gorm.DB) *gorm.DB {
return func(db *gorm.DB) *gorm.DB {
sort := c.DefaultQuery("order", "desc")
order := fmt.Sprintf("`%s` %s", DefaultQuery(c, "sort_by", "id"), sort)
return db.Order(order)
}
}

This issue was found using CodeQL for Go: Database query built from user-controlled sources.

References

Code Behaviors & Features

Detect and mitigate CVE-2024-22196 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →