CKAN Unauthenticated SQL Injection Vulnerability in DataStore Search

A vulnerability allowing unauthenticated SQL injection has been identified in CKAN versions prior to 2.10.10 and 2.11.5. This issue resides in the 'datastore_search_sql' function, where attackers could inject SQL to access private resources and PostgreSQL system information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to private resources and sensitive PostgreSQL system information.

Remediation

Users can upgrade to CKAN versions 2.10.10 or 2.11.5 to address this vulnerability. Alternatively, the DataStore SQL search feature can be disabled by setting 'ckan.datastore.sqlsearch.enabled' to 'false', although this feature is disabled by default.