CVE-2024-41672

DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a
https://github.com/duckdb/duckdb/pull/13133
https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q

Configurations

No configuration.

History

No history.

Information

Published : 2024-07-24 18:15

Updated : 2024-07-25 12:36

NVD link : CVE-2024-41672

Mitre link : CVE-2024-41672

CVE.ORG link : CVE-2024-41672

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2024-41672", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-07-24T18:15:05.527", "references": [{"url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a", "source": "security-advisories@github.com"}, {"url": "https://github.com/duckdb/duckdb/pull/13133", "source": "security-advisories@github.com"}, {"url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0."}, {"lang": "es", "value": "DuckDB es un sistema de gesti\u00f3n de bases de datos SQL. En las versiones 1.0.0 y anteriores, se puede acceder al contenido del sistema de archivos para su lectura usando `sniff_csv`, incluso con `enable_external_access=false`. Esta vulnerabilidad proporciona a un atacante acceso al sistema de archivos incluso cuando se espera que el acceso est\u00e9 deshabilitado y otras funciones similares NO brindan acceso. Parece haber dos vectores de esta vulnerabilidad. En primer lugar, el acceso a archivos que de otro modo no deber\u00edan permitirse. En segundo lugar, el contenido de un archivo se puede leer (por ejemplo, `/etc/hosts`, `proc/self/environ`, etc.) aunque esa no parezca ser la intenci\u00f3n de la funci\u00f3n sniff_csv. Hay una soluci\u00f3n para este problema disponible en la confirmaci\u00f3n c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a y se espera que forme parte de la versi\u00f3n 1.1.0."}], "lastModified": "2024-07-25T12:36:39.947", "sourceIdentifier": "security-advisories@github.com"}