CVE-2023-34600

What it actually does

Unauthenticated SQL injection flaw in the web interface permits arbitrary database queries, including data extraction, modification, or deletion without authentication.

Why it matters to the business

Attackers can access or alter stored log data, risking exposure of sensitive operational information and undermining log analysis capabilities.

How an attack unfolds

An attacker locates an exposed LogAnalyzer instance and submits crafted HTTP requests containing malicious SQL payloads in parameters; the unsanitized input reaches the backend database, enabling execution of attacker-controlled queries to retrieve or manipulate records.

How to fix it

Upgrade Adiscon LogAnalyzer to the latest version that resolves the SQL injection issue; restrict network exposure of the application and deploy web application firewall rules to filter injection attempts until patched.

How to confirm the fix worked

Perform static code analysis or dynamic testing on input handling routines to confirm sanitization of database queries; review database audit logs for absence of unexpected query patterns after changes.

Typical attack path

1. Scan for publicly accessible Adiscon LogAnalyzer instances
2. Identify injectable parameters through automated or manual testing
3. Inject SQL payloads to enumerate database schema and contents
4. Extract sensitive log data or credentials
5. Modify records or pivot to additional systems if database access permits

How to detect it

Inspect web server access logs for requests containing SQL metacharacters, UNION SELECT, or error-inducing payloads; examine backend database logs for queries with unusual syntax or originating from the application server.

• HTTP requests containing 'UNION SELECT'
• HTTP parameters with single quotes followed by SQL keywords
• Database error messages in application responses
• Unexpected SELECT or UPDATE statements in database query logs

What your security team should do

• Immediately limit network access to LogAnalyzer deployments
• Deploy compensating controls such as WAF rules blocking common SQL injection patterns
• Monitor database activity for anomalous queries from the application
• Schedule upgrade to a fixed release as soon as one becomes available