Description

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-10-05T20:17:25.267Z",
  "pubdate": "2026-10-05T20:17:25.267Z",
  "executiveSummary": "A critical security vulnerability has been identified in the Maestro product, specifically within the REST API list endpoints.\nThe vulnerability is classified as an unauthenticated SQL injection, allowing an attacker to manipulate backend database queries via the 'orderBy' query parameter.\nThe flaw permits remote, unauthorized actors to conduct read-only blind SQL injection attacks to exfiltrate data from the underlying database.\nSince the vulnerability does not require any form of authentication, it presents a significant risk to data confidentiality, as attackers can interact with the database without prior system access.\nExploitation allows for the systematic extraction of sensitive information by inferring database content through boolean-based or time-based blind injection techniques.\nOrganizations utilizing Maestro are at risk of unauthorized information disclosure, as the API surface is exposed to remote, network-based exploitation vectors.",
  "technicalDetails": "The vulnerability resides in the request handling logic for the Maestro REST API list endpoints, specifically where the 'orderBy' parameter is processed.\nThe root cause is the improper sanitization and parameterized handling of user-supplied input before it is concatenated into the SQL ORDER BY clause.\nBy injecting malicious SQL syntax into the 'orderBy' parameter, an attacker can alter the query execution logic.\nThe attack flow begins with an unauthenticated remote actor sending a crafted HTTP GET or POST request to an affected list endpoint.\nThe attacker appends a payload to the 'orderBy' parameter designed to trigger conditional database responses, such as 'ORDER BY (SELECT CASE WHEN (1=1) THEN column_name ELSE (SELECT 1 FROM non_existent_table) END)'.\nBecause the application reflects database state changes or timing differences in its response, the attacker can verify the veracity of boolean assertions injected into the query.\nThis methodology enables blind data exfiltration, where the attacker extracts database schema information, table contents, and record data character-by-character.\nThe vulnerability is categorized as a read-only blind SQL injection, meaning while it does not allow for direct administrative command execution or record modification, it provides a powerful vector for complete unauthorized data disclosure.\nThe exposure is global to the REST API, and because authentication is bypassed by the nature of the endpoint design, no specific privilege level is required to initiate the attack.\nThe impact is significant, as it effectively nullifies data protection controls for the database backend, allowing attackers to perform reconnaissance and data harvesting directly through the application's public-facing interface.\nTechnical remediation requires transitioning the 'orderBy' parameter logic to use an allow-list of accepted column names rather than direct string interpolation, ensuring that any user input is validated against a strict set of predefined safe identifiers before being passed to the database driver."
}