https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 15:13:58 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-62251 <p>Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.</p> <p>Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-62251 https://vulnerability.circl.lu/vuln/ghsa-f46q-3v67-fmm4 <p><strong>Affected:</strong> Go: github.com/sipcapture/homer-app</p> <p>### Summary The `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service.</p> <p>### Details **`coordinator/handlers/statistics_v4.go` lines 74-107** — `V4StatisticsQuery`: ```go query := &amp;model.V4StatisticsQuery{} if err = c.Bind(query); err != nil { ... } // No ValidateRawSQL call here — contrast with other handlers: results, err := h.flightService.Query(c.Request().Context(), query.RawQuery) ```</p> <p>**Contrast with `coordinator/handlers/search.go` line 194** — secure pattern not followed: ```go if err := sqlvalidator.ValidateRawSQL(rawQuery); err != nil { return c.JSON(http.StatusBadRequest, ...) } ```</p> <p>`query.RawQuery` is whatever the caller submitted; it is passed verbatim to the FlightSQL/DuckDB backend. The handler is registered under the `protected` group (requires JWT), but given that the default JWT secret is empty (see related advisory), this is effectively pre-authentication on a default deployment.</p> <p>### PoC ```bash # With a valid JWT (or empty JWT secret bypass): curl -s -X POST http://&lt;homer-host&gt;/api/v4/statistics/query \ -H &#34;Authorization: Bearer &lt;jwt&gt;&#34; \ -H &#34;Content-Type: application/json&#34; \ -d &#39;{ &#34;param&#34;: { &#34;query&#34;: [{&#34;rawquery&#34;: &#34;SELECT * FROM information_schema.tables&#34;}] } }&#39; # Returns all ta…</p> <p><strong>Affected:</strong> Go: github.com/sipcapture/homer-app</p> <p>### Summary The `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service.</p> <p>### Details **`coordinator/handlers/statistics_v4.go` lines 74-107** — `V4StatisticsQuery`: ```go query := &amp;model.V4StatisticsQuery{} if err = c.Bind(query); err != nil { ... } // No ValidateRawSQL call here — contrast with other handlers: results, err := h.flightService.Query(c.Request().Context(), query.RawQuery) ```</p> <p>**Contrast with `coordinator/handlers/search.go` line 194** — secure pattern not followed: ```go if err := sqlvalidator.ValidateRawSQL(rawQuery); err != nil { return c.JSON(http.StatusBadRequest, ...) } ```</p> <p>`query.RawQuery` is whatever the caller submitted; it is passed verbatim to the FlightSQL/DuckDB backend. The handler is registered under the `protected` group (requires JWT), but given that the default JWT secret is empty (see related advisory), this is effectively pre-authentication on a default deployment.</p> <p>### PoC ```bash # With a valid JWT (or empty JWT secret bypass): curl -s -X POST http://&lt;homer-host&gt;/api/v4/statistics/query \ -H &#34;Authorization: Bearer &lt;jwt&gt;&#34; \ -H &#34;Content-Type: application/json&#34; \ -d &#39;{ &#34;param&#34;: { &#34;query&#34;: [{&#34;rawquery&#34;: &#34;SELECT * FROM information_schema.tables&#34;}] } }&#39; # Returns all ta…</p> https://vulnerability.circl.lu/vuln/ghsa-f46q-3v67-fmm4