CyberRota Analysis
AI-GeneratedHasura versions prior to 2.49.2 and 2.45.5 are vulnerable to a security flaw that allows users to exploit a where clause on a computed field to infer sensitive row values, potentially bypassing row-level permissions. This could lead to unauthorized data exposure, making it critical for organizations using affected versions to prioritize upgrading to the patched releases. Users managing sensitive data or relying on Hasura for API access should address this vulnerability promptly to mitigate risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.