CVE-2024-43415 — decidim-decidim_awesome
CRITICALFix: decidim-ice/decidim-module-decidim_awesome@8437403CVE-2024-43415 is a critical-severity (CVSS 9) SQL Injection vulnerability in decidim-decidim_awesome. A fix is available for decidim-decidim_awesome — see the affected versions and patch details below.
Decidim-Awesome: SQL injection in AdminAccountability
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2024-43415.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
decidim-decidim_awesome💎decidim-decidim_awesomeReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Vulnerability type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vendor:
Decidim International Community Environment
Has vendor confirmed:
Yes
Attack type:
Remote
Impact:
Code Execution Escalation of Privileges Information Disclosure
Affected component:
A raw sql-statement that uses an interpolated variable exists in the admin_role_actions method of the
papertrail/version-model(app/models/decidim/decidim_awesome/paper_trail_version.rb).
Attack vector:
An attacker with admin permissions could manipulate database queries in order to read out the database,
read files from the filesystem, write files from the filesystem. In the worst case, this could lead to remote code
execution on the server.
Description of the vulnerability for use in the CVE [ℹ] (https://cveproject.github.io/docs/content/key-details-
phrasing.pdf) : An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allows an authenticated admin user to manipulate sql queries
to disclose information, read and write files or execute commands.
Discoverer Credits:
Wolfgang Hotwagner
References:
https://pentest.ait.ac.at/security-advisory/decidim-awesome-sql-injection-in-adminaccountability/ https://portswigger.net/web-security/sql-injection
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | decidim-decidim_awesome | ≥ 0.9.1&&< 0.10.3 | 0.10.3bundle update decidim-decidim_awesome --conservative |
| 💎RubyGems | decidim-decidim_awesome | ≥ 0.11.0&&< 0.11.2 | 0.11.2bundle update decidim-decidim_awesome --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for decidim-decidim_awesome, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update decidim-decidim_awesome to 0.10.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-43415 is resolved across your whole dependency graph.
Workarounds
Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.
Frequently Asked Questions
Is CVE-2024-43415 in your dependencies?
Find it across RubyGems, including transitive dependencies.