Description
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
clickvisual clickvisual
Default version status: unaffected
0 to ≤ 1.1.2affected
pkg:github/clickvisual/clickvisualReferences
- https://hackmd.io/@hieuPenguinnn/clickvisual-report-module-missing-authz-cross-instance-idor ↗
- https://github.com/clickvisual/clickvisual/blob/v1.1.2/api/internal/api/apiv2/report/report.go#L282-L343 ↗
- https://github.com/clickvisual/clickvisual/blob/v1.1.2/api/internal/service/report/metadata.go#L136-L152 ↗
- https://www.vulncheck.com/advisories/clickvisual-through-1.1.2-missing-authorization-in-apiv2-report-module ↗