SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
signoz:signoz
References 9
https://github.com/SigNoz/signoz/security/advisories/GHSA-q3h7-gpc9-2rxc
GitHub Security Advisory (GHSA-q3h7-gpc9-2rxc)
https://github.com/SigNoz/signoz/commit/8e00c0405697659bd4994a5de446cf3028c0f76d
NVD
https://github.com/SigNoz/signoz/commit/9c886be12015c43a1465af3532b3c3afbec6bebc
NVD
https://github.com/SigNoz/signoz/releases/tag/v0.142.0
SigNoz v0.142.0 Release Notes
https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/querybuilder/fallback_expr.g…
NVD
https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/telemetrymetadata/field_mapp…
NVD
https://github.com/SigNoz/signoz/blob/v0.141.1/pkg/apiserver/signozapiserver/qu…
NVD
https://github.com/SigNoz/signoz
NVD
https://www.vulncheck.com/advisories/signoz-0.87.0-before-0.142.0-sql-injection…
NVD