SQL Injection in Dbt-Labs Dbt-Core
CVE-2024-40637
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these components with harmful code. This issue has been fixed in versions 1.8.0, 1.6.14 and 1.7.14. Users are advised to upgrade. There are no kn own workarounds for this vulnerability. Users updating to either 1.6.14 or 1.7.14 will need to set `flags.require_explicit_package_overrides_for_builtin_materializations: False` in their configuration in `dbt_project.yml`.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (28.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 28.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Dbt-Labs Dbt-Core — versions < 1.6.14, >= 1.7.0, < 1.7.14
- Getdbt Dbt Core
Weakness classification (CWE)
References
- github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq (Vendor Advisory)
- github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6 (Patch)
- github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624 (Patch)
- docs.getdbt.com/docs/build/packages (Product)
- docs.getdbt.com/reference/global-configs/legacy-behaviors (Vendor Advisory)
- tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls (Exploit, Third Party Advisory)
- www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dw… (Exploit, Third Party Advisory)
- www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vul… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-40637?
- CVE-2024-40637 is a medium-severity vulnerability in Dbt-Labs Dbt-Core, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 4.2/10. Published 2024-07-16.
- How severe is CVE-2024-40637?
- Medium severity. CVSS v3 base score is 4.2 out of 10.