Description

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQL WHERE clause without parameterization or escaping to perform time-based and boolean-based data exfiltration from the application database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T20:17:22.360Z",
  "pubdate": "2026-09-03T20:17:22.360Z",
  "executiveSummary": "R2R versions through 3.6.6 are susceptible to a critical SQL injection vulnerability originating from improper input handling within the retrieval search endpoint.\nThe vulnerability type is categorized as SQL injection, allowing unauthenticated remote attackers to manipulate database queries by injecting arbitrary SQL predicates.\nThe impact is significant, as it enables unauthorized actors to perform boolean-based and time-based data exfiltration from the underlying application database.\nThis flaw poses a severe risk to data confidentiality, potentially exposing sensitive information stored within the R2R system.\nExploitation requires no authentication, allowing any network-adjacent or remote attacker to interact with the vulnerable endpoint.\nThe root cause is the direct interpolation of user-supplied filter keys into SQL WHERE clauses without adequate parameterization or sanitization mechanisms.",
  "technicalDetails": "The vulnerability exists within the R2R retrieval search endpoint, specifically affecting how the application processes the 'filter' key parameter during chunk search operations.\nThe root cause is identified as an implementation failure to adhere to secure coding practices regarding database interactions. Instead of utilizing prepared statements or parameterized queries, the application directly interpolates the user-provided 'filter' input string into the dynamically constructed SQL WHERE clause.\nBecause the input is not properly sanitized, escaped, or validated before reaching the database engine, an attacker can supply malicious SQL fragments. These fragments break the intended syntax of the query, allowing the attacker to inject arbitrary logical conditions or clauses.\nThe attack flow begins with an unauthenticated attacker sending a crafted HTTP request to the vulnerable retrieval search endpoint. By injecting specific SQL predicates into the 'filter' parameter, the attacker forces the database to evaluate unauthorized logical statements.\nExploitation can manifest as boolean-based or time-based data exfiltration. In boolean-based attacks, the attacker observes differences in the application's response (e.g., presence or absence of search results) based on whether an injected condition evaluates to true or false, allowing the attacker to infer database content character by character.\nIn time-based attacks, the attacker injects commands—such as sleep-inducing functions—that cause the database to delay its response. By measuring the latency of these responses, the attacker can extract data from the database even if the application does not explicitly return the results of the query in the HTTP response body.\nThe scope of impact includes unauthorized read access to the application database. An attacker could potentially map the database schema, identify sensitive tables, and exfiltrate proprietary or user data. This vulnerability affects all R2R instances running version 3.6.6 and earlier.\nSuccessful exploitation requires no prior authentication or administrative privileges, as the vulnerable endpoint is accessible by default to unauthenticated users. This lack of access control and input validation significantly increases the exploitability of the system."
}