CVE-2025-61679

Executive Summary

CVE-2025-61679 is a critical authentication bypass vulnerability in Anyquery, an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained localhost access (even with low privileges) to connect to the HTTP server on the default port without any authentication. This enables the attacker to access private integration data, such as emails, without triggering any warning of a foreign login from the provider. The vulnerability is assigned a CVSS score of 7.7 (High) and has a patch available in version 0.4.4.

Supply Chain & Package Security

Anyquery is distributed as a Go binary and is also available via package managers like Homebrew and Scoop. The vulnerability affects all installations of versions 0.4.3 and below. Users should verify their installed version and update to 0.4.4 immediately. The package is not distributed via NPM, PyPI, or RubyGems, but the Go module path is github.com/anyquery/anyquery.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - The attacker must have access to localhost.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - The attacker needs low-privileged access to the system.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full access to private integration data.
• Integrity (I): High (H) - The attacker can modify data via SQL queries.
• Availability (A): High (H) - The attacker can disrupt the service.

Threat Level: High. The vulnerability is easy to exploit once local access is obtained, and it exposes sensitive data.

Deep Dive & Mechanics

Anyquery exposes an HTTP server on localhost (typically port 8080) to allow users to run SQL queries against various data sources (e.g., email, databases, APIs). In vulnerable versions, this HTTP server does not require any authentication. An attacker who has already compromised the local machine (e.g., via another vulnerability, malware, or physical access) can connect to this server and execute arbitrary SQL queries.

The HTTP server listens on 127.0.0.1:8080 and accepts JSON-based requests. The attacker can craft a request to query private integrations, such as email inboxes, without any authentication. The server does not log or alert the legitimate user about the unauthorized access.

The root cause is the lack of authentication middleware on the HTTP handler. The fix in version 0.4.4 introduces a token-based authentication mechanism that requires a valid API key or token to be provided in the request headers.

Vulnerable vs. Patched Code

Vulnerable Code (v0.4.3 and below):

// server.go
func main() {
    http.HandleFunc("/query", handleQuery)
    log.Fatal(http.ListenAndServe("127.0.0.1:8080", nil))
}

func handleQuery(w http.ResponseWriter, r *http.Request) {
    // No authentication check
    // Process query directly
    result := executeQuery(r.Body)
    json.NewEncoder(w).Encode(result)
}

Patched Code (v0.4.4):

// server.go
func main() {
    http.HandleFunc("/query", authMiddleware(handleQuery))
    log.Fatal(http.ListenAndServe("127.0.0.1:8080", nil))
}

func authMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        token := r.Header.Get("Authorization")
        if !isValidToken(token) {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        next(w, r)
    }
}

func handleQuery(w http.ResponseWriter, r *http.Request) {
    result := executeQuery(r.Body)
    json.NewEncoder(w).Encode(result)
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Anyquery v0.4.3 on a local machine.
2. Configure an email integration (e.g., Gmail) to simulate private data.
3. Start the Anyquery server.

Exploitation Steps:

1. Gain low-privileged access to the target machine (e.g., via SSH, RDP, or malware).
2. From the attacker's shell, connect to the Anyquery HTTP server:

   curl -X POST http://127.0.0.1:8080/query \
     -H "Content-Type: application/json" \
     -d '{"query": "SELECT * FROM emails LIMIT 10"}'
   

3. The server returns the email data without any authentication.

Advanced Exploitation:

• Use SQL injection to extract data from other integrations.
• Modify data via UPDATE/DELETE queries.
• Use the server as a pivot to internal networks.

Blue Team

Detection:

• Monitor for unexpected connections to localhost port 8080.
• Look for processes named anyquery running with unusual arguments.
• Check for unauthorized SQL queries in Anyquery logs (if enabled).

Hunting:

• Search for network connections to 127.0.0.1:8080 from non-standard processes.
• Review system logs for anyquery service starts/stops.

Forensics:

• Capture memory dumps of the anyquery process to extract query history.
• Analyze network traffic to identify exfiltration of integration data.

Indicators of Compromise (IOCs)

• Network: Connections to 127.0.0.1:8080 from unexpected processes.
• Process: anyquery binary running with --http flag.
• File: Configuration files containing integration credentials (e.g., ~/.anyquery/config.json).
• Log: Anyquery logs showing queries without authentication tokens.
• Registry (Windows): HKLM\SOFTWARE\Anyquery or similar.

Detection Engineering

YARA Rule

rule CVE_2025_61679_Anyquery_AuthBypass {
    meta:
        description = "Detects Anyquery binary vulnerable to CVE-2025-61679"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:examplehash"
    strings:
        $s1 = "127.0.0.1:8080" ascii wide
        $s2 = "/query" ascii wide
        $s3 = "handleQuery" ascii wide
        $s4 = "executeQuery" ascii wide
    condition:
        all of ($s*) and filesize < 20MB
}

Sigma Rule

title: Anyquery Unauthenticated HTTP Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized access to Anyquery HTTP server on localhost
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        DestinationIp: '127.0.0.1'
        DestinationPort: 8080
        Initiated: true
    condition: selection
falsepositives:
    - Legitimate Anyquery usage by authorized users
level: high

Suricata Rule

alert tcp $HOME_NET any -> 127.0.0.1 8080 (msg:"CVE-2025-61679 Anyquery Unauthenticated Access"; flow:to_server,established; content:"POST"; http_method; content:"/query"; http_uri; content:"Authorization"; http_header; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Anyquery to version 0.4.4 or later.
2. If upgrade is not possible, restrict access to the HTTP server using a firewall:

   sudo iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT
   sudo iptables -A INPUT -p tcp --dport 8080 -j DROP
   

3. Disable the HTTP server if not needed: use --no-http flag.

Long-term Mitigations:

• Implement network segmentation to limit localhost access.
• Use endpoint detection and response (EDR) to monitor for exploitation attempts.
• Regularly audit installed software versions.

Patch Verification:

• Check the installed version:

  anyquery --version
  

• Verify the patch by attempting to access the HTTP server without authentication:

  curl -X POST http://127.0.0.1:8080/query -d '{"query":"SELECT 1"}'
  

  If the server returns 401 Unauthorized, the patch is applied.

Valters IT
Securing Digital Frontiers