CVE-2024-45794 Overview
CVE-2024-45794 is a SQL injection vulnerability [CWE-89] in Devtron, an open source tool integration platform for Kubernetes. An authenticated user with minimum permissions can execute malicious SQL queries through the CreateUser API endpoint at /orchestrator/user. The flaw allows attackers to compromise the underlying database, potentially exposing sensitive tenant data, credentials, and Kubernetes configuration state managed by Devtron. The maintainers addressed the issue in version 0.7.2, and no workarounds exist. Any Devtron deployment before this release remains exposed to database compromise from low-privilege accounts.
Critical Impact
A low-privilege authenticated attacker can execute arbitrary SQL against the Devtron database, resulting in full confidentiality, integrity, and availability loss for the platform managing Kubernetes clusters.
Affected Products
- Devtron versions prior to 0.7.2
- Devtron deployments running on Kubernetes clusters
- Self-hosted Devtron installations exposing the /orchestrator/user API
Discovery Timeline
- 2024-11-07 - CVE-2024-45794 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45794
Vulnerability Analysis
The vulnerability resides in the CreateUser API handler under the /orchestrator/user route. The endpoint constructs SQL statements using unsanitized input from an authenticated request. An attacker with the minimum authenticated role can inject SQL fragments that alter the intent of the underlying query.
Successful exploitation grants read and write access to the Devtron database. This database stores user records, RBAC policies, cluster credentials, pipeline definitions, and integration secrets. Compromise of these tables can cascade into full control over the managed Kubernetes clusters.
The attack requires network reachability to the Devtron API and valid authentication. Because Devtron is often exposed within internal networks and shared across DevOps teams, low-privilege accounts are common and represent a realistic attack starting point.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. User-controlled fields submitted to the CreateUser endpoint are concatenated into SQL statements without parameterization or input validation. The maintainers refactored the affected query path in version 0.7.2 to use safe query construction.
Attack Vector
An authenticated attacker sends a crafted HTTP request to /orchestrator/user containing SQL metacharacters in a user-controlled field. The malicious payload is embedded into the database query executed by the orchestrator. The attacker can then enumerate schema, exfiltrate rows, modify records, or escalate privileges within Devtron. Refer to the GitHub Security Advisory GHSA-q78v-cv36-8fxj for the maintainer disclosure.
Detection Methods for CVE-2024-45794
Indicators of Compromise
- HTTP POST or PUT requests to /orchestrator/user containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in request bodies
- Unexpected new user records, role bindings, or elevated permissions created in the Devtron database
- Database error responses returned to clients calling the CreateUser API
- Anomalous outbound queries from the Devtron orchestrator pod to internal data stores
Detection Strategies
- Inspect application and reverse-proxy logs for CreateUser requests containing SQL syntax patterns
- Enable PostgreSQL statement logging on the Devtron database and alert on injection signatures against the users table
- Correlate authenticated Devtron session activity with database query volume spikes
- Deploy a web application firewall rule set that flags SQL injection payloads on /orchestrator/* endpoints
Monitoring Recommendations
- Baseline normal CreateUser API call volume and alert on deviations, especially from unexpected source identities
- Monitor Devtron orchestrator pod egress and process activity for signs of secondary exploitation
- Track changes to RBAC and user tables through database audit logging
- Review authentication logs for accounts with minimal permissions performing user-management actions
How to Mitigate CVE-2024-45794
Immediate Actions Required
- Upgrade Devtron to version 0.7.2 or later across all environments
- Rotate database credentials, service account tokens, and integration secrets stored in Devtron if exposure is suspected
- Audit the Devtron user and RBAC tables for unauthorized entries introduced before patching
- Restrict network access to the Devtron API so only trusted DevOps networks can reach /orchestrator/*
Patch Information
The maintainers fixed CVE-2024-45794 in Devtron 0.7.2. All users are advised to upgrade. Details are available in the Devtron GitHub Security Advisory.
Workarounds
- No vendor workarounds exist; upgrading to 0.7.2 is required
- As a compensating control, tighten access to the Devtron API using network policies and identity-aware proxies until the upgrade completes
- Temporarily suspend low-privilege accounts that do not require access during the remediation window
# Verify the running Devtron version and upgrade via Helm
kubectl -n devtroncd get deploy devtron -o jsonpath='{.spec.template.spec.containers[0].image}'
helm repo update
helm upgrade devtron devtron/devtron-operator -n devtroncd --version 0.7.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
