Description

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without parameterization or identifier quoting. Attackers with a self-registered account can substitute arbitrary subqueries to achieve cross-tenant database reads, extract pg_shadow password hashes, read and write arbitrary files, and execute arbitrary code as the postgres OS user by loading attacker-supplied shared objects, with all injected SQL executing at superuser privilege due to the default PostgreSQL role configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T20:16:54.077Z",
  "pubdate": "2026-09-14T20:16:54.077Z",
  "executiveSummary": "Magistrala versions prior to 1.0.0 are susceptible to a critical SQL injection vulnerability within the timescale-reader and postgres-reader HTTP API services.\nThis vulnerability stems from the improper handling of the 'format' query parameter, which is interpolated directly into the SQL FROM clause without sanitization, parameterization, or identifier quoting.\nThe flaw allows authenticated attackers, including those with self-registered accounts, to execute arbitrary SQL commands.\nBecause the services operate with superuser privileges due to default PostgreSQL role configurations, the impact is severe, enabling cross-tenant data exfiltration, unauthorized access to sensitive system metadata (such as pg_shadow password hashes), file system read/write operations, and arbitrary code execution as the postgres OS user via the loading of malicious shared objects.\nThe risk implication is absolute compromise of the database server and the underlying host environment, necessitating immediate patching or configuration remediation to restrict service-level database permissions.",
  "technicalDetails": "The root cause of this vulnerability is a failure to enforce secure coding practices during the construction of database queries in the timescale-reader and postgres-reader components of Magistrala. Specifically, the application logic takes a user-supplied 'format' query parameter from incoming HTTP requests and performs string interpolation directly into the SQL statement's FROM clause. Because the application fails to use parameterized queries (prepared statements) or apply necessary identifier quoting/sanitization for user-provided input, the input is interpreted as part of the SQL command structure.\nAn authenticated attacker can exploit this by crafting a malicious payload within the 'format' parameter. By supplying a string containing SQL subqueries, an attacker can manipulate the structure of the resulting query to bypass intended data access controls. Given the default PostgreSQL configuration where these reader services connect with superuser privileges, the injected SQL is executed with the highest level of database authority.\nThe attack flow follows these steps: 1) The attacker authenticates to the Magistrala platform, potentially utilizing a self-registered account. 2) The attacker sends a crafted HTTP request to the timescale-reader or postgres-reader service, injecting a payload into the 'format' parameter. 3) The backend server processes the input and concatenates it into the SQL query string. 4) The database engine executes the injected command sequence. 5) Through the use of SQL extensions or procedural capabilities available to a superuser, the attacker can interact with the host OS. This includes reading arbitrary files on the filesystem or writing malicious shared object files (e.g., .so files) to the server. 6) By leveraging functionality to load external shared libraries, the attacker achieves arbitrary code execution as the postgres OS user.\nThe post-exploitation impact is catastrophic. Beyond simple cross-tenant data theft or administrative metadata extraction from pg_shadow, the ability to execute code as the database service account provides a gateway for lateral movement within the network, privilege escalation on the underlying host, and full persistence. Because the vulnerability requires only authentication, any account within the Magistrala ecosystem can serve as a vector for total system takeover."
}