Possible SQL Injection vulnerability in hyperv plugin

[Travis McPeak]

On this line: https://github.com/openstack/neutron/blob/master/neutron/plugins/hyperv/agent/utilsv2.py#L190 a raw SQL query is being made with the parameters 'class_name' and 'element_name'. Class name appears to be a hardcoded value in the usage that I saw, but element_name looks like it is set from "switch_port_name". If a malicious user is able to tamper with the switch port name, a SQL injection vulnerability exists.

At least this is an unsafe programming practice. A library such as sqlalchemy should be used, or at least prepared statements.

If there is no way for a user to tamper with these parameters, this can be fixed in public and treated as security hardening rather than a vulnerability.

[Thierry Carrez (ttx)]

@Alessandro: could you tell us if that actually constitutes a true vulnerability ?

[Alessandro Pilotti (alexpilotti)]

Hi guys,

This is WQL, not SQL. There are no security concerns for this case.

Please see comments in the following bug report:
https://bugs.launchpad.net/nova/+bug/1370295

Thanks,

Alessandro

[Jeremy Stanley (fungi)]

Switched the bug to public and marked the security advisory task wontfix based on the above explanation.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/131428

[OpenStack Infra (hudson-openstack)]

Change abandoned by Kyle Mestery (<email address hidden>) on branch: master
Review: https://review.openstack.org/131428
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Armando Migliaccio (armando-migliaccio)]

This bug is > 172 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

[Alessandro Pilotti (alexpilotti)]

Not a bug as by discussion above, thanks