Magistrala
Monthly
Cross-tenant authorization bypass in Magistrala through 1.0.0 allows any authenticated member of a workspace to view, issue, and revoke device certificates belonging to other tenants by supplying foreign serial numbers or entity/device IDs to the certs service (RevokeBySerial, RevokeAll, ViewCert, ListCerts, IssueCert). A successful attacker can disconnect other tenants' devices, disclose their certificates, and mint CA-signed certificates for arbitrary device IDs, giving high integrity and availability impact with limited confidentiality exposure (assessed CVSS:3.1 base 7.2, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H). Exploitation is not pre-authentication, and no public exploit was identified at time of analysis; the practical risk is greatest on multi-tenant deployments that actively use the certificate service.
Authenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any user who can self-register inject arbitrary SQL through the unparameterized `format` query parameter, which is interpolated straight into the FROM clause of backend queries. Because the injected statements run as a PostgreSQL superuser under the default role configuration, an attacker can pivot from cross-tenant data theft to reading pg_shadow password hashes, reading and writing arbitrary files, and executing OS-level code as the postgres user via shared-object loading. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the vendor has released a fix in v1.0.0.
SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipulation by any authenticated platform user. The unvalidated `format` HTTP query parameter is interpolated directly into raw SQL at the table-name identifier position via Go's `fmt.Sprintf()` in both readers/postgres/messages.go and readers/timescale/messages.go, enabling exfiltration of database contents with high confidentiality impact (CVSS C:H). The wildcard CPE (cpe:2.3:a:absmach:magistrala:*) indicates all known versions are affected; no vendor-released patch has been confirmed in available references, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-tenant authorization bypass in Magistrala through 1.0.0 allows any authenticated member of a workspace to view, issue, and revoke device certificates belonging to other tenants by supplying foreign serial numbers or entity/device IDs to the certs service (RevokeBySerial, RevokeAll, ViewCert, ListCerts, IssueCert). A successful attacker can disconnect other tenants' devices, disclose their certificates, and mint CA-signed certificates for arbitrary device IDs, giving high integrity and availability impact with limited confidentiality exposure (assessed CVSS:3.1 base 7.2, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H). Exploitation is not pre-authentication, and no public exploit was identified at time of analysis; the practical risk is greatest on multi-tenant deployments that actively use the certificate service.
Authenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any user who can self-register inject arbitrary SQL through the unparameterized `format` query parameter, which is interpolated straight into the FROM clause of backend queries. Because the injected statements run as a PostgreSQL superuser under the default role configuration, an attacker can pivot from cross-tenant data theft to reading pg_shadow password hashes, reading and writing arbitrary files, and executing OS-level code as the postgres user via shared-object loading. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the vendor has released a fix in v1.0.0.
SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipulation by any authenticated platform user. The unvalidated `format` HTTP query parameter is interpolated directly into raw SQL at the table-name identifier position via Go's `fmt.Sprintf()` in both readers/postgres/messages.go and readers/timescale/messages.go, enabling exfiltration of database contents with high confidentiality impact (CVSS C:H). The wildcard CPE (cpe:2.3:a:absmach:magistrala:*) indicates all known versions are affected; no vendor-released patch has been confirmed in available references, and no public exploit code or CISA KEV listing has been identified at time of analysis.