Summary
A SQL injection vulnerability exists in FilterDataServiceCE.java where the dropTable method constructs a SQL DROP TABLE statement using string concatenation with the table name. If the table name is derived from user input, this allows for arbitrary SQL command execution.
Details
The vulnerability is located in app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java.
Line 627 in dropTable method:
public void dropTable(String tableName) {
String dropTableQuery = "DROP TABLE " + tableName + ";";
executeDbQuery(dropTableQuery);
}The tableName argument is concatenated directly into the SQL string without validation or escaping.
PoC
If dropTable is exposed to user input (e.g., via a utility API that accepts a table name to clean up), an attacker could provide a value like:
valid_table; DROP TABLE users; --
The resulting query would be:
DROP TABLE valid_table; DROP TABLE users; --;
This would delete the intended table and then delete the users table (or execute any other injected SQL).
Impact
- Type: SQL Injection
- Impact: Data Loss (Drop Table), potentially Data Exfiltration or Modification depending on database permissions.
- Who is impacted: Appsmith server instances.
References
liyander Reporter
Summary
A SQL injection vulnerability exists in
FilterDataServiceCE.javawhere thedropTablemethod constructs a SQLDROP TABLEstatement using string concatenation with the table name. If the table name is derived from user input, this allows for arbitrary SQL command execution.Details
The vulnerability is located in
app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java.Line 627 in
dropTablemethod:The
tableNameargument is concatenated directly into the SQL string without validation or escaping.PoC
If
dropTableis exposed to user input (e.g., via a utility API that accepts a table name to clean up), an attacker could provide a value like:valid_table; DROP TABLE users; --The resulting query would be:
DROP TABLE valid_table; DROP TABLE users; --;This would delete the intended table and then delete the
userstable (or execute any other injected SQL).Impact
References