Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugin…
Info
Summary
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables() from server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash option. For a ClickHouse-backed chart with variable binding, an attacker can supply a backslash before a quote so quote doubling does not keep the value …
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/chartbrew/chartbrew/commit/5f95d07b5fee7f69c9d1242b5c99ea11ff046341
- https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3
- https://github.com/chartbrew/chartbrew/security/advisories/GHSA-5jgv-45cw-hc53
Timeline
- nvd_ingest NVD