CVE-2024-41672

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-41672", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-07-18T15:21:47.486Z", "datePublished": "2024-07-24T17:47:20.626Z", "dateUpdated": "2024-08-02T04:46:52.916Z"}, "containers": {"cna": {"title": "DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q"}, {"name": "https://github.com/duckdb/duckdb/pull/13133", "tags": ["x_refsource_MISC"], "url": "https://github.com/duckdb/duckdb/pull/13133"}, {"name": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a", "tags": ["x_refsource_MISC"], "url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a"}], "affected": [{"vendor": "duckdb", "product": "duckdb", "versions": [{"version": "<= 1.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-24T17:47:20.626Z"}, "descriptions": [{"lang": "en", "value": "DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0."}], "source": {"advisory": "GHSA-w2gf-jxc9-pf2q", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "duckdb", "product": "duckdb", "cpes": ["cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-24T18:07:30.477604Z", "id": "CVE-2024-41672", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T18:10:49.801Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:46:52.916Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q"}, {"name": "https://github.com/duckdb/duckdb/pull/13133", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/duckdb/duckdb/pull/13133"}, {"name": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q", "name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/duckdb/duckdb/pull/13133", "name": "https://github.com/duckdb/duckdb/pull/13133", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a", "name": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:46:52.916Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41672", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-24T18:07:30.477604Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*"], "vendor": "duckdb", "product": "duckdb", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T18:09:59.366Z"}}], "cna": {"title": "DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled", "source": {"advisory": "GHSA-w2gf-jxc9-pf2q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "duckdb", "product": "duckdb", "versions": [{"status": "affected", "version": "<= 1.0.0"}]}], "references": [{"url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q", "name": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/duckdb/duckdb/pull/13133", "name": "https://github.com/duckdb/duckdb/pull/13133", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a", "name": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-24T17:47:20.626Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41672", "state": "PUBLISHED", "dateUpdated": "2024-08-02T04:46:52.916Z", "dateReserved": "2024-07-18T15:21:47.486Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-07-24T17:47:20.626Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "duckdb", "vendor": "duckdb", "versions": [{"status": "affected", "version": "<= 1.0.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "duckdb", "vendor": "duckdb", "versions": [{"lessThanOrEqual": "1.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "83AE278C-3F41-40B0-8AE5-3F5D9DFE359A", "versionEndExcluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0."}, {"lang": "es", "value": "DuckDB es un sistema de gesti\u00f3n de bases de datos SQL. En las versiones 1.0.0 y anteriores, se puede acceder al contenido del sistema de archivos para su lectura usando `sniff_csv`, incluso con `enable_external_access=false`. Esta vulnerabilidad proporciona a un atacante acceso al sistema de archivos incluso cuando se espera que el acceso est\u00e9 deshabilitado y otras funciones similares NO brindan acceso. Parece haber dos vectores de esta vulnerabilidad. En primer lugar, el acceso a archivos que de otro modo no deber\u00edan permitirse. En segundo lugar, el contenido de un archivo se puede leer (por ejemplo, `/etc/hosts`, `proc/self/environ`, etc.) aunque esa no parezca ser la intenci\u00f3n de la funci\u00f3n sniff_csv. Hay una soluci\u00f3n para este problema disponible en la confirmaci\u00f3n c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a y se espera que forme parte de la versi\u00f3n 1.1.0."}], "id": "CVE-2024-41672", "lastModified": "2026-06-17T07:48:01.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-41672", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-07-24T18:07:30.477604Z", "version": "2.0.3"}}]}, "published": "2024-07-24T18:15:05.527", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/duckdb/duckdb/pull/13133"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/duckdb/duckdb/pull/13133"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}