Query Context Trusted from Client Bypasses Data Access Controls

Summary

An authenticated, low-privilege user could read data from databases or tables they were not permitted to access. Exploitation requires a logged-in session but not admin privileges.

Details

Two related paths in query handling trusted client-supplied fields in the request body:

• A query with a permitted source-table could wrap a source-query whose embedded SQL fragment was executed by thedriver without the outer permission check inspecting it.
• The card creation pipeline accepted a client-supplied permission context attached to dataset_query and honored it during execution instead of deriving the requesting user'sactual authorization from group memberships and sandboxing configuration.

In both cases the caller could execute native SQL against tables or databases outside their granted scope. The fix re-derives the query context on the server and validates query

parameters at the API boundary so that the embedded SQL and the permission context are no longer read from the request.

Patches

The fix is available in the following versions and above:

• 1.54.23, 0.54.23
• 1.55.23, 0.55.23
• 1.56.23, 0.56.23
• 1.57.17, 0.57.17
• 1.58.12, 0.58.12
• 1.59.6, 0.59.6
• 1.60.1, 0.60.1

Credit

Aikido Security — Jorian Woltjer, Rein Daelman, Robbe Verwilghen