Description
Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| keephq | keep | 0.34.10 ≤0.55.0 | — |
References
- https://vul.yulun.ac.cn/20261030/keephq_keep/
- https://github.com/keephq/keep/issues/6902
- https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/sql_providers/sqlite.py#L16-L18
- https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/sql_providers/postgresql.py#L22-L26
- https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/cel_ast_converter.py#L278-L290
- https://www.vulncheck.com/advisories/keep-0.34.10-through-0.55.0-blind-sql-injection-via-cel-bracket-indexed-json-keys