OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

Summary

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.

Remediation

1. Inventory every opensearch-project sql deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4
• Referencehttps://github.com/opensearch-project/sql/pull/5469
• Referencehttps://github.com/opensearch-project/sql/pull/5572
• Referencehttps://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de
• Referencehttps://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db
• Referencehttps://github.com/opensearch-project/sql/releases/tag/2.19.6.0
• Referencehttps://github.com/opensearch-project/sql/releases/tag/3.7.0.0