ASF Foundation Reveals High-Risk Vulnerability in Traffic Control Component Reported by Tencent's Yunding Lab: SQL Injection Vulnerability

This is the third security issue disclosed by the ASF Foundation recently, focusing mainly on the CVE-2024-45387 vulnerability, reported by researchers from Tencent's Yunding Security Lab.

The vulnerability is located in the Apache Traffic Control component, which is used to establish Content Delivery Networks (CDNs) that deliver content to users quickly and efficiently.

The CVE-2024-45387 vulnerability has a CVSS score of 9.9/10. If exploited successfully, attackers could execute arbitrary Structured Query Language (SQL) commands in the database.

The project maintainers stated in the announcement:

A SQL injection vulnerability exists in Traffic Ops within versions 8.0.0 to 8.0.1 of Apache Traffic Control, allowing privileged users with administrator, federation, operations, portal, and steering roles to execute arbitrary SQL commands in the database by sending specially crafted PUT requests.

Users of this module should immediately upgrade to version 8.0.2, released in October 2024. The delay in disclosing the vulnerability until now was to prevent attackers from reverse-engineering the new version to discover and exploit the vulnerability.