Impact
SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database.
Patches
The following patches (or greater versions) are available:
- 0.42.4 and 1.42.4
- 0.41.7 and 1.41.7
If you use SQLite databases, where other users can write SQL queries, you should upgrade immediately.
All releases are available on https://github.com/metabase/metabase/releases
Credits
Reported by https://github.com/Cl0wnK1n9 via security@ email
Impact
SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database.
Patches
The following patches (or greater versions) are available:
If you use SQLite databases, where other users can write SQL queries, you should upgrade immediately.
All releases are available on https://github.com/metabase/metabase/releases
Credits
Reported by https://github.com/Cl0wnK1n9 via security@ email