CVE-2024-41672

Executive Summary

CVE-2024-41672 is a high-severity information disclosure vulnerability in DuckDB, an in-process SQL OLAP database management system. The flaw resides in the sniff_csv function, which, contrary to its intended design, allows reading arbitrary files from the filesystem even when the enable_external_access=false setting is enforced. This bypasses a critical security control intended to prevent external file access. An attacker with the ability to execute SQL queries against a DuckDB instance can read sensitive files such as /etc/hosts, /proc/self/environ, or application configuration files, leading to credential disclosure, system reconnaissance, and potential lateral movement. The vulnerability affects all versions up to and including 1.0.0. A fix is available in the development branch and is expected in version 1.1.0.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Sensitive filesystem content can be read.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service impact.

Threat Level: High. The vulnerability is trivial to exploit and provides direct access to the underlying filesystem, bypassing a key security control.

Deep Dive & Mechanics

The sniff_csv function in DuckDB is designed to automatically detect the schema and delimiter of a CSV file by reading its header. To do this, it must open and read the file. The security setting enable_external_access=false is intended to prevent DuckDB from accessing external files, databases, or network resources. However, the sniff_csv function does not respect this setting, allowing an attacker to read any file the DuckDB process has access to.

The vulnerability manifests in two primary vectors:

1. Unauthorized File Access: The attacker can read files that should be blocked by the enable_external_access restriction.
2. Data Exfiltration: The content of sensitive files (e.g., /etc/hosts, /proc/self/environ) can be read and potentially returned in query results, allowing the attacker to exfiltrate system information.

The root cause is a missing access control check in the sniff_csv implementation. Other similar functions (e.g., read_csv_auto) correctly check the enable_external_access flag, but sniff_csv does not.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.0.0): The sniff_csv function directly opens the file without checking the enable_external_access setting.

// Vulnerable: No access control check
void SniffCSVFunction(DataChunk &args, ExpressionState &state, Vector &result) {
    auto &input = args.data[0];
    // Directly opens the file
    auto file_handle = file_system->OpenFile(input.GetValue<string>(0), FileFlags::READ);
    // ... process file
}

Patched Code (commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a): The patched version adds a check for enable_external_access before opening the file.

// Patched: Access control check added
void SniffCSVFunction(DataChunk &args, ExpressionState &state, Vector &result) {
    auto &input = args.data[0];
    // Check if external access is allowed
    if (!db->config.options.enable_external_access) {
        throw PermissionException("sniff_csv: external access is disabled");
    }
    auto file_handle = file_system->OpenFile(input.GetValue<string>(0), FileFlags::READ);
    // ... process file
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A DuckDB instance (version <= 1.0.0) accessible via SQL queries.
• The ability to execute arbitrary SQL statements.

Exploitation Steps:

1. Connect to the DuckDB instance (e.g., via JDBC, CLI, or HTTP API).
2. Execute the following SQL query to read a sensitive file:

SELECT sniff_csv('/etc/hosts');

This will return the contents of /etc/hosts as a CSV-like result, revealing internal host mappings.

3. Read environment variables or process information:

SELECT sniff_csv('/proc/self/environ');

This will expose environment variables, potentially containing credentials, API keys, or other secrets.

4. Exfiltrate the data by capturing the query output.

Alternative Vector: If the attacker can write files, they could use sniff_csv to read arbitrary files and then exfiltrate via a network call (e.g., using http_* functions if enabled).

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor DuckDB logs for unusual sniff_csv calls targeting non-CSV files (e.g., /etc/passwd, /proc/*).
2. Audit SQL queries for patterns like sniff_csv('/etc/') or sniff_csv('/proc/').
3. Implement network segmentation to limit DuckDB instance exposure.
4. Apply the patch as soon as it becomes available (expected in version 1.1.0).
5. Use a Web Application Firewall (WAF) or database proxy to block suspicious queries.

Mitigation Workaround: If patching is not immediately possible, restrict filesystem access at the OS level (e.g., using AppArmor, SELinux, or container security policies) to prevent DuckDB from reading sensitive files.

Indicators of Compromise (IOCs)

• Log Entries: DuckDB logs containing sniff_csv calls with paths like /etc/, /proc/, /sys/, or other sensitive directories.
• Network Traffic: Outbound connections from the DuckDB process to external IPs (if exfiltration is attempted).
• File Access: Unusual file access patterns detected by the OS (e.g., DuckDB reading /etc/shadow).
• Process Behavior: DuckDB process opening file handles to sensitive system files.

Example IOC Log Entry:

[2024-08-20 10:15:30] INFO: Query: SELECT sniff_csv('/etc/hosts');

Detection Engineering

YARA Rule

rule Detect_DuckDB_SniffCSV_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-41672 by sniffing sensitive files"
        author = "Valters IT"
        date = "2024-08-20"
        reference = "CVE-2024-41672"
    strings:
        $sensitive_path1 = "/etc/"
        $sensitive_path2 = "/proc/"
        $sensitive_path3 = "/sys/"
        $sensitive_path4 = "/var/log/"
        $sniff_csv = "sniff_csv"
    condition:
        $sniff_csv and any of ($sensitive_path*)
}

Sigma Rule

title: DuckDB SniffCSV Sensitive File Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DuckDB queries using sniff_csv to access sensitive files
author: Valters IT
date: 2024-08-20
logsource:
    category: application
    product: duckdb
detection:
    selection:
        Query|contains:
            - "sniff_csv('/etc/"
            - "sniff_csv('/proc/"
            - "sniff_csv('/sys/"
            - "sniff_csv('/var/log/"
    condition: selection
falsepositives:
    - Legitimate use of sniff_csv on CSV files in allowed directories
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"DuckDB SniffCSV Exploit - Sensitive File Access"; flow:to_server,established; content:"sniff_csv"; nocase; content:"/etc/"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to DuckDB version 1.1.0 or later as soon as it is released. If using a development build, apply commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a.
2. Workaround: If patching is not possible, restrict the DuckDB process's filesystem access using OS-level controls:
   • AppArmor: Create a profile that denies read access to sensitive directories.
   • SELinux: Apply a policy that limits DuckDB's file read capabilities.
   • Container Security: Run DuckDB in a container with a read-only root filesystem and only mount necessary directories.
3. Network Segmentation: Ensure DuckDB instances are not exposed to untrusted networks. Use firewalls to restrict access to trusted IPs only.
4. Monitoring: Implement the detection rules provided above to identify exploitation attempts.
5. Audit: Review all DuckDB deployments for usage of sniff_csv and ensure it is only used on trusted CSV files.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert