Blind SQL Injection in Decidim Admin Search

Executive Summary

This vulnerability affects the Decidim participatory democracy framework. It allows an authenticated organization administrator to execute blind PostgreSQL expressions through a search function before input sanitization. The issue occurs in specific versions where raw user input is interpolated into SQL ORDER BY clauses without proper protection.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the Decidim version and reviewing admin user search functionality for blind PostgreSQL timing attacks. Check Decidim version with: bundle exec rake decidim:version. Review logs for suspicious admin user searches with timing delays. Ensure PostgreSQL query logs are enabled to detect unusual similarity queries.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrative access could exploit this to infer sensitive data through timing differences in database queries. This could lead to unauthorized data exposure or manipulation of system behavior, though it requires existing administrative privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This could lead to unauthorized access to sensitive user data, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if such data is processed.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Decidim to versions 0.30.9, 0.31.5, or 0.32.0.rc2 or later. If upgrading is not possible, restrict access to admin user search functionality for organization administrators. Review and sanitize all user input in ORDER BY clauses. Monitor database logs for unusual timing patterns in queries.

Useful 0 Not Useful 0