Executive brief
OneUptime is an open-source observability platform that collects and analyzes logs, metrics, and trace data in a ClickHouse database. A SQL injection vulnerability allows authenticated users to inject malicious SQL commands through sort, select, and groupBy request parameters, enabling unauthorized access to, modification of, or deletion of stored analytics data.
Technical details
OneUptime's StatementGenerator class constructs ClickHouse SQL queries by iterating over user-provided object keys from API request bodies without validating that they correspond to actual database columns. The toSortStatement, toSelectStatement, and toGroupByStatement methods pass unsanitized column names as ClickHouse Identifier parameters, which are substituted directly into queries without escaping. An authenticated attacker can inject arbitrary ClickHouse SQL through crafted sort, select, or groupBy parameters in requests to analytics list or aggregate endpoints (BaseAnalyticsAPI.getList or BaseAnalyticsAPI.getAggregate), allowing reading, modifying, or deleting analytics data. The vulnerability was introduced because an incomplete fix for a previous SQL injection vulnerability (GHSA-p5g2-jm85-8g35) applied validation only to the _aggregateBy method but not to the three other vulnerable query construction methods. PostgreSQL data is not affected. Fix: Applied in version 10.0.34.
Affected products
- OneUptime OneUptime all versions up to and including 10.0.23
Timeline
- 2026-03-18: disclosed: GHSA-gcg3-c5p2-cqgg published
- 2026-03-18: patched: Fix released in version 10.0.34