Description
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| growthbook | growthbook | ≤ 5.0.1 | — |
References
- GitHub Issue #6541 issue-tracking
- https://github.com/growthbook/growthbook product
- https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/services/reports.ts#L880-L890 technical-description
- https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/app.ts#L391-L409 technical-description
- VulnCheck Advisory: GrowthBook through 5.0.1 Information Disclosure via Public Endpoints third-party-advisory