CVE-2024-24213: Supabase Postgres SQLi Vulnerability

CVE-2024-24213 Overview

CVE-2024-24213 is a reported SQL injection vulnerability affecting Supabase PostgreSQL v15.1. The vulnerability was identified in the /pg_meta/default/query component. However, it is important to note that the vendor disputes this classification, stating that this is an intended feature within the Supabase dashboard product, not the Supabase PostgreSQL product itself. According to Supabase, the /pg_meta/default/query endpoint is designed for SQL queries entered through an authorized user interface, meaning there is no actual injection occurring.

Critical Impact

While initially classified as a SQL injection vulnerability with network-based attack potential, the vendor contends this represents intended functionality for authorized database query execution through the Supabase dashboard SQL Editor.

Affected Products

• Supabase Postgres v15.1

Discovery Timeline

• 2024-02-08 - CVE-2024-24213 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24213

Vulnerability Analysis

The reported vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The vulnerability allegedly exists in the /pg_meta/default/query component of Supabase PostgreSQL v15.1.

The core of this issue centers on whether the SQL query execution capability represents a security flaw or intended functionality. The component in question allows users to execute SQL queries through the Supabase dashboard interface. Supabase maintains that this feature is by design—the SQL Editor is explicitly intended to allow authorized users to run arbitrary SQL queries against their databases.

This dispute highlights an important distinction in vulnerability classification: features that intentionally provide powerful capabilities to authenticated, authorized users are not inherently vulnerabilities, even if those capabilities could theoretically be misused. The SQL Editor is a core administrative tool for database management within the Supabase platform.

Root Cause

The root cause analysis depends on interpretation. The reporter identified the /pg_meta/default/query endpoint as accepting and executing SQL queries without additional sanitization. From a traditional SQL injection perspective, this would represent a failure to properly sanitize user input before database execution.

However, Supabase's position is that the endpoint functions exactly as designed—it is meant to execute SQL queries provided by authorized users through the dashboard UI. The "injection" is therefore not exploitation but rather the intended use case of a database administration tool. The endpoint requires proper authentication and authorization before queries can be executed.

Attack Vector

The vulnerability is categorized as network-accessible, meaning it could theoretically be exploited remotely. However, the practical attack vector depends heavily on whether an attacker could gain unauthorized access to the Supabase dashboard or bypass authentication mechanisms.

For legitimate users, the SQL Editor provides direct database access as an expected feature. Any exploitation would require:

1. Compromising user credentials for Supabase dashboard access
2. Exploiting a separate authentication bypass vulnerability
3. Man-in-the-middle attacks on authenticated sessions

The disputed nature of this CVE means organizations should evaluate their specific Supabase deployment configurations and access controls rather than treating this as a traditional SQL injection vulnerability requiring immediate patching.

Detection Methods for CVE-2024-24213

Indicators of Compromise

• Unusual or unauthorized access attempts to the /pg_meta/default/query endpoint
• Database query logs showing unexpected or malicious SQL commands
• Authentication anomalies in Supabase dashboard access logs
• Unexpected data exfiltration or modification patterns in database audit trails

Detection Strategies

• Monitor authentication logs for the Supabase dashboard to detect unauthorized access attempts
• Implement database activity monitoring to track all queries executed through the SQL Editor
• Review access control configurations to ensure only authorized personnel have dashboard access
• Deploy network monitoring to detect unusual traffic patterns to Supabase endpoints

Monitoring Recommendations

• Enable comprehensive logging for all database operations and dashboard access
• Configure alerts for queries that modify database structure or access sensitive tables
• Regularly audit user access permissions and remove unnecessary privileges
• Implement session monitoring to detect hijacking or unauthorized session reuse

How to Mitigate CVE-2024-24213

Immediate Actions Required

• Review and restrict access to the Supabase dashboard to only essential personnel
• Audit existing dashboard user accounts and remove any unauthorized or unnecessary access
• Implement strong authentication mechanisms including multi-factor authentication (MFA)
• Review database query logs for any suspicious activity

Patch Information

As Supabase considers this functionality to be intended behavior rather than a vulnerability, there is no specific security patch addressing this issue. Organizations concerned about this capability should consult the Supabase Database Overview Guide for guidance on proper SQL Editor usage and access control configuration. Additional technical details can be found in the GitHub CVE-2024-24213 Details repository.

Workarounds

• Implement strict role-based access control (RBAC) for the Supabase dashboard
• Use network-level restrictions (IP allowlisting) to limit dashboard access to trusted networks
• Consider implementing a database proxy or query review process for production environments
• Enable database audit logging to maintain visibility into all executed queries
• Regularly review and rotate dashboard credentials

# Example: Restrict dashboard access via network configuration
# Configure firewall rules to limit access to Supabase dashboard
# Allow only specific IP ranges for administrative access

# Review current dashboard users and permissions
# Audit authentication logs for unauthorized access attempts
# Enable MFA for all dashboard user accounts