Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2.
Version 2.0.2 fixes string parameters, while version 2.5.1 fixes all known vectors. Upgrading to 2.5.1 or later is the only complete fix. In versions 2.0.2 through 2.5.0, serializing non-scalar parameters with JSON.stringify() before passing them is a workaround for the object/array vector only.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
hypequery:hypequery
References 8
https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.…
security-advisories@github.com
https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d1…
security-advisories@github.com
https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2
security-advisories@github.com
https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
security-advisories@github.com
https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff0551…
security-advisories@github.com
https://github.com/hypequery/hypequery/commit/2dc1df7bae
security-advisories@github.com
https://github.com/hypequery/hypequery/pull/349
security-advisories@github.com
https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.5.1
security-advisories@github.com