This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: SQL Injection in Windmill's folder ownership logic. π₯ **Consequences**: Attackers can read sensitive data, forge admin tokens, and execute arbitrary code.β¦
π‘οΈ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. π **Flaw**: The `owner` parameter in the folder ownership management feature is not sanitized, allowing malicious SQL payloads.
Q3Who is affected? (Versions/Components)
π¦ **Product**: Windmill CE (Community Edition) by Windmill Labs. π **Affected Versions**: 1.276.0 through 1.603.2. If you are outside this range, you are safe.
Q4What can hackers do? (Privileges/Data)
π΅οΈ **Privileges**: Can forge management tokens to impersonate admins. π **Data**: Full access to read sensitive database contents. π» **Impact**: Remote Code Execution (RCE) is possible via token forgery.
Q5Is exploitation threshold high? (Auth/Config)
π **Auth Required**: Yes. PR:L (Privileges Required: Low). π« **UI**: No User Interaction needed. β οΈ **Network**: Attackable over Network (AV:N). You need a low-level account to exploit this.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exploit**: YES. π **Source**: GitHub repo `Chocapikk/Windfall`. π **Details**: Technical description available at `chocapikk.com`. Wild exploitation is highly likely given the PoC is public.
Q7How to self-check? (Features/Scanning)
π **Check**: Scan for Windmill instances running versions 1.276.0-1.603.2. π **Feature**: Look for folder ownership API endpoints. π§ͺ **Test**: Inject SQL payloads into the `owner` parameter.β¦
β **Fixed**: YES. π¦ **Patch**: Version **1.603.3** is the safe release. π **Action**: Upgrade immediately to v1.603.3 or later. Check the official GitHub release notes for confirmation.
Q9What if no patch? (Workaround)
π§ **No Patch?**: Restrict network access to the Windmill instance. π **Mitigation**: Disable folder ownership modification features if possible.β¦
π¨ **Urgency**: CRITICAL. π΄ **Priority**: P1. With public exploits and RCE potential, patch immediately. Do not wait. CVSS Score indicates High impact on Confidentiality, Integrity, and Availability.