Summary
WhoDB contains a path traversal vulnerability in its query editor that can expose filesystem operations through DuckDB functions. An attacker who can reach the affected query functionality may read or overwrite arbitrary host files, potentially disclosing session keys and stored database credentials.
WhoDB contains a path traversal vulnerability in its query editor that can expose filesystem operations through DuckDB functions. An attacker who can reach the affected query functionality may read or overwrite arbitrary host files, potentially disclosing session keys and stored database credentials.
Affected context
The issue affects WhoDB deployments using the vulnerable query editor and DuckDB integration. It becomes risky when an attacker can access a DuckDB file or invoke DuckDB filesystem functions through the application, including deployments where the relevant database access does not require normal credentials. The resulting file operations may occur against the host filesystem available to the WhoDB process.
The issue affects WhoDB deployments using the vulnerable query editor and DuckDB integration. It becomes risky when an attacker can access a DuckDB file or invoke DuckDB filesystem functions through the application, including deployments where the relevant database access does not require normal credentials. The resulting file operations may occur against the host filesystem available to the WhoDB process.
Exploit preconditions
- Attack surface: Remote query editor and DuckDB filesystem-function handling
- Required access: Ability to reach the query interface or access a DuckDB file; normal database credentials may not be required in the affected flow
- Trigger point: Execution of filesystem-capable DuckDB functions or statements such as file reads, writes, copies, or attachments
- Why exploitation is possible: User-controlled file paths are passed to filesystem operations without sufficiently restricting traversal outside intended database locations
- Attack surface: Remote query editor and DuckDB filesystem-function handling
- Required access: Ability to reach the query interface or access a DuckDB file; normal database credentials may not be required in the affected flow
- Trigger point: Execution of filesystem-capable DuckDB functions or statements such as file reads, writes, copies, or attachments
- Why exploitation is possible: User-controlled file paths are passed to filesystem operations without sufficiently restricting traversal outside intended database locations
Why this happens
The underlying flaw is improper neutralization and validation of user-controlled filesystem paths, mapping to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The application exposes DuckDB functionality that can access files while failing to establish an effective path boundary, allowing relative or otherwise attacker-selected paths to reference unintended host files. The absence of strong authorization and filesystem isolation can expand the consequences from database querying to arbitrary file access.
The underlying flaw is improper neutralization and validation of user-controlled filesystem paths, mapping to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The application exposes DuckDB functionality that can access files while failing to establish an effective path boundary, allowing relative or otherwise attacker-selected paths to reference unintended host files. The absence of strong authorization and filesystem isolation can expand the consequences from database querying to arbitrary file access.
Potential impact
- An attacker may read sensitive host files
- Session keys and stored database credentials could be disclosed
- Arbitrary application or configuration files could be overwritten
- WhoDB integrity and availability could be affected
- Compromised credentials may enable further access to connected systems
- An attacker may read sensitive host files
- Session keys and stored database credentials could be disclosed
- Arbitrary application or configuration files could be overwritten
- WhoDB integrity and availability could be affected
- Compromised credentials may enable further access to connected systems
General mitigation guidance
Mitigation generally focuses on removing unrestricted filesystem capabilities from query execution and reducing trust in user-supplied paths.
Common defensive patterns include:
- Restricting or disabling DuckDB functions and statements that access host files
- Canonicalizing paths and enforcing an allowlisted, dedicated data directory
- Applying authorization checks before database-file access and query execution
- Running WhoDB with a dedicated low-privilege account and minimal filesystem permissions
- Keeping session keys and database credentials outside directories accessible to the application
- Using container, sandbox, and read-only filesystem controls where practical
- Separating query execution from sensitive host resources
Mitigation generally focuses on removing unrestricted filesystem capabilities from query execution and reducing trust in user-supplied paths.
Common defensive patterns include:
- Restricting or disabling DuckDB functions and statements that access host files
- Canonicalizing paths and enforcing an allowlisted, dedicated data directory
- Applying authorization checks before database-file access and query execution
- Running WhoDB with a dedicated low-privilege account and minimal filesystem permissions
- Keeping session keys and database credentials outside directories accessible to the application
- Using container, sandbox, and read-only filesystem controls where practical
- Separating query execution from sensitive host resources
How teams detect issues like this
Detection can include static analysis and code review for user-controlled paths passed to DuckDB filesystem functions, including file reads, writes, copies, and attachments. Reviewers can look for missing canonicalization, directory-boundary checks, allowlists, authorization checks, and privilege separation. Runtime monitoring may alert on query execution involving filesystem functions, access to sensitive paths, unexpected file modifications, and unusual reads outside the intended database directory. Policy enforcement can prohibit unrestricted filesystem access from web-facing query features, while automated security review tools may help identify dangerous path-handling patterns.
Detection can include static analysis and code review for user-controlled paths passed to DuckDB filesystem functions, including file reads, writes, copies, and attachments. Reviewers can look for missing canonicalization, directory-boundary checks, allowlists, authorization checks, and privilege separation. Runtime monitoring may alert on query execution involving filesystem functions, access to sensitive paths, unexpected file modifications, and unusual reads outside the intended database directory. Policy enforcement can prohibit unrestricted filesystem access from web-facing query features, while automated security review tools may help identify dangerous path-handling patterns.
