Executive brief
Dataease SQLbot, a tool used for managing and querying databases, contains a security flaw in its Elasticsearch integration. An attacker could exploit this to force the server to make unauthorized requests to internal or external systems. This could lead to the exposure of internal network information or unauthorized access to private services, potentially disrupting operations or leaking sensitive data.
Technical details
A server-side request forgery (SSRF) vulnerability exists in Dataease SQLbot versions up to 1.6.0. The flaw is located in the 'get_es_data_by_http' function within 'backend/apps/db/es_engine.py' of the Elasticsearch Handler component. By manipulating the 'address' argument, a remote attacker with high privileges can force the server to issue requests to arbitrary locations. This can be used to scan internal networks, bypass firewalls, or interact with internal services that are not otherwise accessible from the internet. The issue is addressed in version 1.7.0.
Affected products
- Dataease SQLbot Up to 1.6.0
Timeline
- 2026-03-19: patched: Version 1.7.0 released
- 2026-04-02: disclosed: Initial public disclosure
- 2026-04-02: advisory: NVD publication date