Description
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SigNoz | signoz | 0.88.0 – < 0.142.1 | 0.142.1 |
References
- GitHub Security Advisory (GHSA-w5pf-xwjh-vr5v) vendor-advisory
- Partial fix, released 0.142.0 patch
- Residual two-step fix, released 0.142.1 patch
- SigNoz v0.142.1 Release Notes release-notes
- Residual unescaped interpolation at the last affected release technical-description
- The six affected analytics routes and their view-access wrapper technical-description
- https://github.com/SigNoz/signoz product
- VulnCheck Advisory: SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders third-party-advisory