| Titre | zhongyu09 OpenChatBI 1.0 SQL Injection |
|---|
| Description | An incomplete SQL safety validation in OpenChatBI allows arbitrary file read and potential remote code execution on PostgreSQL backends. The function _validate_sql_safety() in openchatbi/text2sql/generate_sql.py blocks DDL/DML operations (DROP, INSERT, UPDATE, DELETE) but fails to block dangerous PostgreSQL functions that enable filesystem access and OS command execution.
Affected File: openchatbi/text2sql/generate_sql.py
Affected Function: _validate_sql_safety() (line 59)
Missing blocked patterns:
- pg_read_file() — arbitrary file read
- COPY ... TO PROGRAM — remote code execution
- dblink() / dblink_exec() — SSRF and remote query execution
- lo_import() / lo_export() — large object file access
- load_extension() — SQLite arbitrary code execution
PoC Steps:
1. Deploy OpenChatBI connected to a PostgreSQL database
2. Send a natural language query that causes the LLM to generate: SELECT pg_read_file('/etc/passwd')
3. The query passes _validate_sql_safety() (returns True) and executes against the database
4. Server filesystem contents are returned to the attacker
Tested: SELECT pg_read_file('/etc/passwd') passes validation and returns file contents when executed against PostgreSQL 18.
Impact: Any user who can send natural language queries to an OpenChatBI instance can read arbitrary files from the database server. With COPY TO PROGRAM, full remote code execution is achievable.
Reference: https://github.com/zhongyu09/openchatbi |
|---|
| La source | ⚠️ https://github.com/zhongyu09/openchatbi |
|---|
| Utilisateur | Yogender (UID 99560) |
|---|
| Soumission | 05/07/2026 12:42 (il y a 2 mois) |
|---|
| Modérer | 01/09/2026 07:45 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 397552 [zhongyu09 OpenChatBI jusqu’à 0.3.0 generate_sql.py _validate_sql_safety injection SQL] |
|---|
| Points | 20 |
|---|