OneUptime ClickHouse SQL Injection Vulnerability in Query Parameter Handling

A SQL injection vulnerability has been identified in OneUptime's ClickHouse integration, affecting versions prior to 10.0.34. The issue arises in the StatementGenerator component, where user-controlled keys from API request bodies are interpolated into ClickHouse queries without proper validation. This flaw allows authenticated users to inject arbitrary SQL through crafted sort, select, or groupBy parameters, potentially leading to unauthorized access or manipulation of analytics data stored in ClickHouse.

Impact

Exploitation of this vulnerability allows authenticated users to inject and execute arbitrary SQL in ClickHouse, with the potential to read, modify, or delete analytics data such as logs, metrics, traces, and exceptions.

Remediation

Users can upgrade to OneUptime version 10.0.34 or later to address this vulnerability.