Description
FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cern-fts | fts-monitoring | 3.12.0 – < 3.13.3, 3.14.0 – < 3.14.1 | 3.13.3 |
References
- EGI SVG Advisory EGI-SVG-2025-09 third-party-advisory
- Patch Commit patch
- Backport Commit (3.13.3) patch
- Vulnerable get_linkinfo at v3.14.0 technical-description
- fts-monitoring v3.14.1 Release Notes release-notes
- fts-monitoring v3.13.3 Release Notes release-notes
- https://github.com/cern-fts/fts-monitoring product
- VulnCheck Advisory: FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo third-party-advisory