Summary
Lotus contains a SQL injection vulnerability in billable metric processing, where authenticated organization users can submit crafted property or categorical filter values.
Because these values may be rendered unescaped into Jinja-generated metric queries, an attacker could access or manipulate data in the database shared across tenants.
Lotus contains a SQL injection vulnerability in billable metric processing, where authenticated organization users can submit crafted property or categorical filter values.
Because these values may be rendered unescaped into Jinja-generated metric queries, an attacker could access or manipulate data in the database shared across tenants.
Affected context
The issue occurs in Lotus deployments through version 0.10.2 when authenticated organization users can define or influence billable metric property_name values or categorical filter values. The risk is present when those values are incorporated into generated counter, gauge, or rate SQL queries without parameterization or context-appropriate escaping.
The issue occurs in Lotus deployments through version 0.10.2 when authenticated organization users can define or influence billable metric property_name values or categorical filter values. The risk is present when those values are incorporated into generated counter, gauge, or rate SQL queries without parameterization or context-appropriate escaping.
Exploit preconditions
- Attack surface: Billable metric configuration and metric query generation
- Required access: Authenticated access as an organization user with permission to supply or modify relevant metric values
- Trigger point: Processing a counter, gauge, or rate metric query
- Why exploitation is possible: User-controlled values are inserted into Jinja-generated SQL without adequate parameterization, allowing SQL syntax to alter the intended query
- Attack surface: Billable metric configuration and metric query generation
- Required access: Authenticated access as an organization user with permission to supply or modify relevant metric values
- Trigger point: Processing a counter, gauge, or rate metric query
- Why exploitation is possible: User-controlled values are inserted into Jinja-generated SQL without adequate parameterization, allowing SQL syntax to alter the intended query
Why this happens
The underlying bug is an unsafe construction of SQL statements from user-controlled metric fields.
When property names or categorical filter values are interpolated into Jinja-generated queries instead of being handled through structured query construction and parameter binding, SQL syntax supplied by a user can be interpreted as part of the query. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
The underlying bug is an unsafe construction of SQL statements from user-controlled metric fields.
When property names or categorical filter values are interpolated into Jinja-generated queries instead of being handled through structured query construction and parameter binding, SQL syntax supplied by a user can be interpreted as part of the query. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
Potential impact
- Unauthorized access to data stored in the shared database
- Exposure of records belonging to other tenants
- Modification or deletion of database information
- Bypass of intended metric filtering and authorization boundaries
- Degradation of application availability through resource-intensive queries
- Unauthorized access to data stored in the shared database
- Exposure of records belonging to other tenants
- Modification or deletion of database information
- Bypass of intended metric filtering and authorization boundaries
- Degradation of application availability through resource-intensive queries
General mitigation guidance
Mitigation generally focuses on removing string-based SQL construction from user-influenced paths and reducing the trust placed in organization-provided metric values.
Common defensive patterns include:
- Use parameterized queries, prepared statements, or query-builder abstractions for data values
- Represent allowed property names and filter operators through constrained identifiers rather than raw strings
- Apply strict allowlists and schema validation to metric definitions
- Keep tenant scoping and authorization predicates enforced independently of user-controlled filters
- Run database access with a least-privilege account and separate tenant data where practical
- Avoid treating escaping alone as a substitute for structured query construction
Mitigation generally focuses on removing string-based SQL construction from user-influenced paths and reducing the trust placed in organization-provided metric values.
Common defensive patterns include:
- Use parameterized queries, prepared statements, or query-builder abstractions for data values
- Represent allowed property names and filter operators through constrained identifiers rather than raw strings
- Apply strict allowlists and schema validation to metric definitions
- Keep tenant scoping and authorization predicates enforced independently of user-controlled filters
- Run database access with a least-privilege account and separate tenant data where practical
- Avoid treating escaping alone as a substitute for structured query construction
How teams detect issues like this
Organizations commonly detect SQL injection risks through:
- Static analysis rules identifying string interpolation or template rendering in SQL construction
- Code review checks for Jinja, format-string, or concatenation use near database queries
- Tests that verify parameter binding for metric filters and property inputs
- Runtime database monitoring for anomalous query syntax, cross-tenant access patterns, and unexpected statement errors
- Policy enforcement requiring approved query-builder or parameterized database APIs
- Automated security review tools that flag untrusted data flows into SQL execution paths
Organizations commonly detect SQL injection risks through:
- Static analysis rules identifying string interpolation or template rendering in SQL construction
- Code review checks for Jinja, format-string, or concatenation use near database queries
- Tests that verify parameter binding for metric filters and property inputs
- Runtime database monitoring for anomalous query syntax, cross-tenant access patterns, and unexpected statement errors
- Policy enforcement requiring approved query-builder or parameterized database APIs
- Automated security review tools that flag untrusted data flows into SQL execution paths
