Summary
ThingLinks contains a critical unauthenticated SQL injection vulnerability in the TDengine TDS APIs. Request-controlled JSON values can reach unsafe SQL construction, allowing a remote attacker to tamper with time-series data by inserting unintended rows or altering existing readings.
ThingLinks contains a critical unauthenticated SQL injection vulnerability in the TDengine TDS APIs. Request-controlled JSON values can reach unsafe SQL construction, allowing a remote attacker to tamper with time-series data by inserting unintended rows or altering existing readings.
Affected context
The vulnerability occurs in ThingLinks deployments using the TDS module's insert-table-data flow and TDengine mapper. It affects requests sent to /anyUser/tds/insertTableData when JSON field values are incorporated into SQL statements without adequate parameterization or equivalent query-safety controls. Exploitation does not depend on an authenticated application session.
The vulnerability occurs in ThingLinks deployments using the TDS module's insert-table-data flow and TDengine mapper. It affects requests sent to /anyUser/tds/insertTableData when JSON field values are incorporated into SQL statements without adequate parameterization or equivalent query-safety controls. Exploitation does not depend on an authenticated application session.
Exploit preconditions
- Attack surface: The exposed TDengine TDS insert-table-data API
- Required access: Network access to the API; authentication is not required
- Trigger point: Processing request-controlled JSON fields through the TDS mapper
- Why exploitation is possible: Untrusted values reach SQL construction without sufficient separation from query logic
- Attack surface: The exposed TDengine TDS insert-table-data API
- Required access: Network access to the API; authentication is not required
- Trigger point: Processing request-controlled JSON fields through the TDS mapper
- Why exploitation is possible: Untrusted values reach SQL construction without sufficient separation from query logic
Why this happens
The underlying bug is SQL injection caused by combining request-controlled data with dynamically constructed SQL statements. When input values are treated as query fragments rather than bound data, an attacker may influence database operations and their effects. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
The underlying bug is SQL injection caused by combining request-controlled data with dynamically constructed SQL statements. When input values are treated as query fragments rather than bound data, an attacker may influence database operations and their effects. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
Potential impact
- An attacker may insert unauthorized time-series rows
- Existing readings could be modified or overwritten
- Application data integrity may be compromised
- Downstream analytics, monitoring, or automation could be affected
- Database availability or confidentiality could be impacted depending on query privileges
- An attacker may insert unauthorized time-series rows
- Existing readings could be modified or overwritten
- Application data integrity may be compromised
- Downstream analytics, monitoring, or automation could be affected
- Database availability or confidentiality could be impacted depending on query privileges
General mitigation guidance
Mitigation generally focuses on ensuring that request data cannot alter SQL structure and that the database account has only the permissions required by the TDS workflow.
Common defensive patterns include:
- Using parameterized queries or prepared statements for all request-derived values
- Avoiding string concatenation when constructing SQL statements
- Applying allowlisted validation for identifiers, columns, and permitted operation types
- Enforcing strict input schemas and rejecting unexpected fields or types
- Separating data-access permissions by function and applying least privilege
- Restricting public exposure of data-ingestion endpoints where business requirements allow
- Logging rejected requests and database-side anomalies without recording sensitive values unnecessarily
Mitigation generally focuses on ensuring that request data cannot alter SQL structure and that the database account has only the permissions required by the TDS workflow.
Common defensive patterns include:
- Using parameterized queries or prepared statements for all request-derived values
- Avoiding string concatenation when constructing SQL statements
- Applying allowlisted validation for identifiers, columns, and permitted operation types
- Enforcing strict input schemas and rejecting unexpected fields or types
- Separating data-access permissions by function and applying least privilege
- Restricting public exposure of data-ingestion endpoints where business requirements allow
- Logging rejected requests and database-side anomalies without recording sensitive values unnecessarily
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules that flag SQL construction using request parameters
- Code review checks for string interpolation, concatenation, or formatting in database queries
- Tests that verify special characters remain data rather than changing query behavior
- API gateway policies enforcing authentication, schema validation, and rate limits where appropriate
- Database audit logs showing unusual insert, update, or overwrite patterns
- Automated security review tools that identify unparameterized query paths
Organizations can look for this class of issue through:
- Static analysis rules that flag SQL construction using request parameters
- Code review checks for string interpolation, concatenation, or formatting in database queries
- Tests that verify special characters remain data rather than changing query behavior
- API gateway policies enforcing authentication, schema validation, and rate limits where appropriate
- Database audit logs showing unusual insert, update, or overwrite patterns
- Automated security review tools that identify unparameterized query paths
