Description

FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T01:17:47.737Z",
  "pubdate": "2026-11-06T01:17:47.737Z",
  "executiveSummary": "FTS3 Web Monitoring is susceptible to a critical unauthenticated SQL injection vulnerability within the /linkinfo endpoint. This flaw arises from improper sanitization of user-supplied input in the source_se and dest_se query parameters, allowing remote, unauthenticated attackers to execute arbitrary SQL commands against the backend database.\nThe vulnerability poses a severe risk to data confidentiality, as it facilitates blind SQL injection attacks. Successful exploitation enables unauthorized actors to exfiltrate sensitive information stored within the database, including cloud storage credentials and token provider client secrets. Because the vulnerability is accessible without authentication, the attack surface is exposed to any remote entity capable of reaching the monitoring service over the network.\nThe affected versions include 3.12.0 through 3.13.2 and 3.14.0. Given the sensitivity of the exposed credentials, this vulnerability represents a significant security compromise, potentially leading to unauthorized access to linked cloud storage resources and auxiliary service accounts. Organizations utilizing these versions are at high risk of credential harvesting and subsequent lateral movement or data exfiltration.",
  "technicalDetails": "The vulnerability resides in the /linkinfo endpoint, specifically within the get_linkinfo function responsible for processing incoming HTTP requests. The root cause is the insecure handling of the source_se and dest_se parameters, which are concatenated into database queries without sufficient validation, sanitization, or the use of parameterized statements.\nThe attack flow begins when an attacker sends a crafted GET request to the /linkinfo endpoint. By appending malicious SQL fragments to the source_se or dest_se parameters, an attacker can manipulate the structure of the backend SQL query. Since the application does not utilize prepared statements, the database engine interprets the injected strings as part of the command syntax rather than literal data inputs.\nThis is classified as a blind SQL injection vulnerability, where the application may not return direct database errors or data in the response body. Instead, attackers utilize inference techniques—such as time-based or boolean-based blind injection—to systematically extract information. By observing the application's response behavior (e.g., response latency or variations in content length), an attacker can extract data character by character from the underlying database tables.\nThe impact of a successful exploit is significant due to the nature of the data stored in the FTS3 monitoring database. Specifically, attackers target columns containing cloud storage credentials and token provider client secrets. By exfiltrating these assets, the attacker bypasses authentication mechanisms and gains control over external cloud infrastructures or API services linked to the FTS3 platform.\nThis vulnerability is particularly dangerous because it requires zero authentication, allowing an unauthenticated remote attacker to initiate the attack sequence from any external network. The attack is performed via standard HTTP request vectors, making it difficult to detect without robust web application firewall (WAF) rules configured to inspect query parameters for SQL syntax. The affected components are limited to versions 3.12.0 through 3.13.2 and 3.14.0, which lack the necessary input filtering mechanisms required to neutralize injection attempts in the affected function."
}