Executive brief
Anyquery is a tool that allows users to run SQL queries on various data sources like JSON files or logs. When running in server mode, it fails to restrict where it can fetch data from, allowing an attacker to force the server to make requests to internal systems. This could lead to the theft of sensitive cloud credentials or unauthorized access to private internal services that are not normally accessible from the internet.
Technical details
Anyquery's 'server' mode accepts MySQL protocol connections and allows the creation of dynamic virtual tables using modules such as 'json_reader' or 'log_reader'. These modules utilize the 'go-getter' library to fetch remote URLs without validating or restricting the destination IP addresses. An unauthenticated remote attacker can exploit this Server-Side Request Forgery (SSRF) vulnerability to probe internal network services (127.0.0.1, 10.0.0.0/8) or exfiltrate sensitive IAM credentials from Cloud Metadata services (169.254.169.254). The vulnerability is addressed in version 0.4.5 by implementing restrictions on local and private IP ranges.
Affected products
- julien040 anyquery < 0.4.5
Timeline
- 2026-06-09: disclosed: Initial disclosure by reporter
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Version 0.4.5 released