https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 11:39:12 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-8462 <p>SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.</p> <p>SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API.</p> https://db.gcve.eu/vuln/fkie_cve-2026-8462 https://db.gcve.eu/vuln/ghsa-wc3v-3457-c8cm <p><strong>Affected:</strong> Go: github.com/openmeterio/openmeter</p> <p>### Summary</p> <p>An authenticated tenant can inject arbitrary SQL through the `valueProperty` or `groupBy` fields of `POST /api/v1/meters`. The injection passes the application&#39;s JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no row-level security. Any authenticated tenant can read or write every other tenant&#39;s metering data.</p> <p>### Details</p> <p>`openmeter/streaming/clickhouse/utils_query.go:15` builds a ClickHouse `SELECT` by interpolating user input with `fmt.Sprintf`:</p> <p>```go sb.Select(fmt.Sprintf(&#34;JSON_VALUE(&#39;{}&#39;, &#39;%s&#39;)&#34;, sqlbuilder.Escape(d.jsonPath))) ```</p> <p>`sqlbuilder.Escape()` (go-sqlbuilder v1.40.2) only replaces `$` → `$$` to prevent collisions with the library&#39;s own argument placeholders. It does not escape single quotes. A single quote in the input closes the string literal, and subsequent tokens execute as raw SQL. `sb.Build()` always returns an empty `args` slice — the query is never parameterized.</p> <p>The payload must be prefixed with a valid JSONPath expression (e.g. `$.foo`) because ClickHouse raises error code 36 (BAD_ARGUMENTS) on an empty JSONPath string, which `ValidateJSONPath` silently treats as &#34;invalid JSONPath&#34; and returns early — before the injected branch can execute.</p> <p>Working payload: ``` $.foo&#39;) UNION ALL SELECT toString(sleep(3)) FROM system.one -- ```</p> <p>Generated SQL: ```sql SELECT JSON_VALUE(&#39;{}&#39;, &#39;$.foo&#39;) UNION ALL SELECT toString(sleep(3)) FROM system.one --&#39; ```</p> <p>Fix — replace…</p> <p><strong>Affected:</strong> Go: github.com/openmeterio/openmeter</p> <p>### Summary</p> <p>An authenticated tenant can inject arbitrary SQL through the `valueProperty` or `groupBy` fields of `POST /api/v1/meters`. The injection passes the application&#39;s JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no row-level security. Any authenticated tenant can read or write every other tenant&#39;s metering data.</p> <p>### Details</p> <p>`openmeter/streaming/clickhouse/utils_query.go:15` builds a ClickHouse `SELECT` by interpolating user input with `fmt.Sprintf`:</p> <p>```go sb.Select(fmt.Sprintf(&#34;JSON_VALUE(&#39;{}&#39;, &#39;%s&#39;)&#34;, sqlbuilder.Escape(d.jsonPath))) ```</p> <p>`sqlbuilder.Escape()` (go-sqlbuilder v1.40.2) only replaces `$` → `$$` to prevent collisions with the library&#39;s own argument placeholders. It does not escape single quotes. A single quote in the input closes the string literal, and subsequent tokens execute as raw SQL. `sb.Build()` always returns an empty `args` slice — the query is never parameterized.</p> <p>The payload must be prefixed with a valid JSONPath expression (e.g. `$.foo`) because ClickHouse raises error code 36 (BAD_ARGUMENTS) on an empty JSONPath string, which `ValidateJSONPath` silently treats as &#34;invalid JSONPath&#34; and returns early — before the injected branch can execute.</p> <p>Working payload: ``` $.foo&#39;) UNION ALL SELECT toString(sleep(3)) FROM system.one -- ```</p> <p>Generated SQL: ```sql SELECT JSON_VALUE(&#39;{}&#39;, &#39;$.foo&#39;) UNION ALL SELECT toString(sleep(3)) FROM system.one --&#39; ```</p> <p>Fix — replace…</p> https://db.gcve.eu/vuln/ghsa-wc3v-3457-c8cm