Description (CNA)
SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated into ClickHouse queries to read all stored traces, logs, and metrics, or abuse the url() function to perform server-side request forgery.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SigNoz / signoz | affected 0 through 0.130.1 |
CWE
CWE-89
References
- https://github.com/SigNoz/signoz/issues/11747
- https://www.vulncheck.com/advisories/signoz-sql-injection-in-alert-history-endpoints-via-rule-id-parameter
ADP enrichment
No English description supplied.
No references supplied.