DuckDB I/O Functions Arbitrary File Read Vulnerability and Fix

Vulnerability Overview This vulnerability involves security issues in DuckDB user queries, remediated by setting and . The vulnerability allows authenticated users (even with limited privileges) to read arbitrary local files via DuckDB's I/O function family (such as , , , , , , , etc.). The user SQL whitelist only blocked , , and RBAC checks for / clauses, allowing table scanning functions to bypass these two layers when used in . Combined with the loaded extension, attackers can access SSRF (instance metadata IP), encryption, and cross-tenant Parquet reads. Scope of Impact Affected Components: DuckDB's I/O function family. Attacker Privileges: Authenticated users, even with limited privileges. Potential Risks: Reading arbitrary local files, including sensitive data such as SSRF endpoints, encryption keys, and cross-tenant data. Remediation Plan 1. Operator-facing Changes: - Parse , , , and as absolute paths, converting forward slashes to backward slashes before passing them to DuckDB. - Reject control bytes, Unicode formatting characters, or line/paragraph separators (Cc, Cf, Zl, Zp) in the operator. - Deny system roots (such as , , , , , , , , , , , , ) for to prevent sandbox bypass. - Move multipart uploads from to , and create an subdirectory. - Temporarily share the same allowed directories for the S3 backend and profile-mode query files, locking them upon request. - Temporarily share the same allowed directories for operations on the S3 backend and profile-mode query files, locking them upon request. - The Arc loader uses a one-time and during . Previously, the per-connection relied on the incorrect assumption that DuckDB extension state is per-connection. 2. Test Plan: - Build and test internal APIs. - Test the Sandbox subset: CVE reproduction, SSRF, COPY to local, COPY to , external allowlist, EXPORT DATABASE, INSTALL, cross-connection enforcement post-locking, , callable functions, and one-way locking. - Test : 12 cases covering horizontal S3 URL sanitization, same bucket with different prefixes, collapsing leading/trailing slashes, parent directory traversal, fallback behavior, trailing slash idempotency, and empty configuration behavior. - Test : Confirm that sandbox locking works even with an empty allowed list (operator sanitization failure test). - Arc integration tests: Confirm and propagate database-level allowed directories via the actual binary. - Build and test Arc smoke tests: Verify correct results for local Parquet data and JSON query paths across 20 query benchmarks. 3. Internal Review: - Three rounds of multi-agent post-implementation review identified 5 blockers and several medium-priority issues. - All findings were resolved in the same commit. The structural CVE fix did not change from Round 1, but Rounds 2 and 3 strengthened wiring and closed defensive vulnerabilities that might be encountered in production deployments. POC Code The code block above demonstrates key parts of the remediation plan, including the rejection of system roots, symbolic link resolution for upload directories, path resolution for Arc storage roots, and the explicit denial of specific directories.

Goal Reached Thanks to every supporter — we hit 100%!

DuckDB I/O Functions Arbitrary File Read Vulnerability and Fix

More from this source