Executive brief
OneUptime is an open-source monitoring and incident management platform. The telemetry analytics API fails to validate user-supplied aggregation query parameters, allowing authenticated users to inject arbitrary SQL into the underlying ClickHouse database. An attacker can read telemetry data from all customers/projects, modify or delete data, and potentially execute remote code through ClickHouse functions.
Technical details
The vulnerability is a SQL injection in the analytics aggregation endpoints (/api/log/aggregate, /api/span/aggregate, /api/metric/aggregate). User-controlled parameters (aggregationType, aggregateColumnName, aggregationTimestampColumnName) are deserialized from the request body with no schema validation and concatenated directly into ClickHouse SQL queries via the .append() method, which performs raw string concatenation. The aggregationType field passes only a truthiness check (if (aggregateBy.aggregationType)) rather than validation against an allowlist of safe values (e.g., COUNT, SUM, AVG). An authenticated user of any role can craft a POST request containing SQL injection payloads in aggregationType to execute arbitrary queries, exfiltrate cross-tenant telemetry data, or abuse ClickHouse table functions for file reading. A patch is available in version 10.0.23.
Affected products
- OneUptime OneUptime 10.0.22
Timeline
- 2026-03-13: disclosed
- 2026-03-13: patched: Version 10.0.23 contains the fix