Description
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Openpanel-dev openpanel
Default version status: unaffected
0 to < 3.0.0affected3.0.0unaffected
References
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-8wr9-x797-f238 ↗
- https://github.com/Openpanel-dev/openpanel/commit/35ddc8ebbcd4ed0767933de61f014f153d68442a ↗
- https://www.vulncheck.com/advisories/openpanel-before-3.0.0-unauthenticated-clickhouse-sql-injection-via-live-visitors-websocket ↗