CVE-2021-47748

An attacker sends a crafted GraphQL query to the run_sql endpoint, injecting malicious system commands (command injection). The attack mechanism exploits PostgreSQL functionality called COPY FROM PROGRAM, which allows execution of system shell commands directly from an SQL query. By appropriately manipulating the SQL query passed to this endpoint, an attacker can achieve full code execution on the target server.

An attacker can execute arbitrary system commands on the server hosting Hasura GraphQL Engine, leading to complete system compromise, data exfiltration, and potential lateral movement within the internal network.

Apply patches available from the vendor according to the references provided. Additionally, it is recommended to restrict access to the run_sql endpoint exclusively to trusted, authenticated users and implement appropriate firewall rules blocking unauthorized access to the GraphQL interface.

Hasura GraphQL Engine version 1.3.3