Description
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
clidey whodb
Default version status: unaffected
0.104.0 to < 0.135.0affected
pkg:github/clidey/whodbReferences
- https://github.com/clidey/whodb/security/advisories/GHSA-x3h5-pr45-fx4r ↗
- https://github.com/clidey/whodb/commit/80111c9ebc2eec382222629ba9fd26236f1a40e6 ↗
- https://github.com/clidey/whodb/releases/tag/0.135.0 ↗
- https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/duckdb.go#L375-L387 ↗
- https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/db.go#L73-L95 ↗
- https://www.vulncheck.com/advisories/whodb-0.104.0-before-0.135.0-arbitrary-file-read-write-via-duckdb-query-editor ↗