[CKAN-Security] Fwd: security vulnerability in CKAN
matt.moore at okfn.org
Mon Mar 2 08:18:43 UTC 2015
---------- Forwarded message ----------
From: dophine britanico <dophine at gmail.com>
Date: 2 March 2015 at 07:48
Subject: Re: security vulnerability in CKAN
To: Matt Moore <matt.moore at okfn.org>
Thank you I believe in responsible security disclosure so I contacted you
here is what i found while auditing our CKAN server.
vulnerability: CKAN API
SQL injection points: ?sql=INJECT HERE
Install JSON View plugin for firefox or chrome
Vulnerable URL will returned sensitive information, Persistent attacker
will use and escalate this to a total server compromise.
This can be also directly fingerprinted and replicated to any website using
Vulnerable as well is US data portal www.data.gov, in which I have also
contacted them in case respond from yours is delayed
Sanitize or remove 'sql' input paramater from datastore_search_sql
Remove api_info.html?resource_id sample query sample from default install
On Mon, Mar 2, 2015 at 3:27 PM, Matt Moore <matt.moore at okfn.org> wrote:
> If you could provide us with some information, then we can look into the
> vulnerability. I've mentioned this to our development team, but without
> some information, there's not much we can do.
> Matthew Moore
> On 2 March 2015 at 06:13, dophine britanico <dophine at gmail.com> wrote:
>> I would like to inform you of a remote and serious vulnerability in the
>> default and recent version of CKAN and probably all recent versions of CKAN.
>> Please contact me anytime.
>> Dophine "Michael" Britanico
>> Security Researcher
>> (+63) 9151100672
> Matthew Moore
> Open Knowledge - www.okfn.org
> Skype - notmatt
Open Knowledge - www.okfn.org
Skype - notmatt
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Security