← back
CVE-2021-47748

Hasura GraphQL 1.3.3 - Remote Code Execution

CVSS 9.3 CRITICALEPSS 1.0%CWE-78
Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's COPY FROM PROGRAM functionality.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Hasura · GraphQL
public PoCs found — 1
cve_referencewww.exploit-db.com/exploits/49802unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/hasura/graphql-enginehttps://www.exploit-db.com/exploits/49802https://www.vulncheck.com/advisories/hasura-graphql-remote-code-execution