Unauthenticated SQL Injection in Metacat Data Repository

Executive Summary

This vulnerability is an unauthenticated SQL injection in Metacat versions 2.0.0 and above, specifically in the /harvesterRegistration endpoint.

The issue arises because the HarvesterRegistration.dbInsert() method builds an SQL INSERT query using string concatenation without properly escaping input, allowing attackers to inject malicious SQL code.

Three request parameters—unit, contactEmail, and documentListURL—are vulnerable to this attack.

Since the servlet does not verify LDAP identities, attackers can exploit this flaw without authentication to execute arbitrary SQL commands.

This grants full read, write, and execute access to the Metacat database, potentially compromising the entire data repository.

A second-order SQL injection also exists where an attacker-controlled documentListURL is fetched and parsed unsafely, further increasing risk.

The vulnerability was fixed in Metacat 3.0.0 by removing the vulnerable harvesterClient package.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows unauthenticated attackers to execute arbitrary SQL commands on the Metacat database.

• Full read access to sensitive data stored in the database.
• Full write access, allowing attackers to modify or delete data.
• Execution of arbitrary SQL commands, potentially leading to complete compromise of the database.

Because no authentication is required and no user interaction is needed, the vulnerability is easy to exploit remotely.

This can lead to data breaches, data loss, or disruption of services relying on the Metacat data repository.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability exists in the /harvesterRegistration endpoint of Metacat versions 2.x through 2.19.1, where unauthenticated SQL injection is possible via the parameters unit, contactEmail, and documentListURL.

Detection can focus on monitoring HTTP requests to the /harvesterRegistration endpoint for suspicious or malformed input in these parameters that could indicate SQL injection attempts.

Network or system administrators can use web server logs or network traffic inspection tools to identify unusual POST requests targeting /harvesterRegistration with SQL syntax or payloads.

Specific commands are not provided in the resources, but general approaches include using tools like curl or wget to test the endpoint manually, or employing web vulnerability scanners configured to test for SQL injection on these parameters.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Metacat to version 3.0.0 or later, preferably 3.4.0 or above, where the vulnerability has been fixed by removing the vulnerable harvesterClient package.

If upgrading is not immediately possible, a workaround is to disable the vulnerable 1.x API servlets, including the /harvesterRegistration endpoint, by editing the Apache Tomcat web.xml configuration file to restrict or block access.

Most deployments have already upgraded to 3.x, which minimizes exposure, so verifying your version and upgrading is critical.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to perform SQL injection attacks on the Metacat database, granting full read, write, and execute access. This can lead to unauthorized access, modification, or deletion of sensitive data stored in the system.

Such unauthorized access and potential data breaches can negatively impact compliance with data protection regulations and standards like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.

Specifically, the exposure of sensitive personal or health data through this vulnerability could result in violations of these regulations, leading to legal and financial consequences for affected organizations.

Useful 0 Not Useful 0