Anyquery (< 0.4.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/anyquery--0.4.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 14 Jul 2026 20:39:43 +0000Anyquery Server-Side Request Forgery via Unrestricted SQLite Virtual Table Moduleshttps://feed.craftedsignal.io/briefs/2026-07-anyquery-ssrf/Tue, 14 Jul 2026 20:39:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-anyquery-ssrf/Unauthenticated attackers can exploit a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-54628) in Anyquery's `server` mode (versions prior to 0.4.5) by creating SQLite virtual tables that fetch internal network resources or cloud metadata, leading to internal network mapping and exfiltration of sensitive information like cloud credentials.Anyquery, a tool for querying various data sources, contains a critical Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-54628, in its server mode. When anyquery server is launched, it exposes a MySQL-compatible interface. Versions prior to 0.4.5 allow unauthenticated attackers to create dynamic virtual tables using modules such as json_reader or log_reader. These modules leverage go-getter to fetch URLs without restricting access to local (127.0.0.0/8), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or cloud metadata (169.254.169.254) IP addresses. This allows attackers to bypass network segmentation, scan internal ports, interact with internal APIs, and exfiltrate cloud credentials (e.g., AWS IAM tokens) from the underlying host. The vulnerability poses a significant risk to the confidentiality of internal network data and cloud environments.

Attack Chain

  1. An unauthenticated attacker initiates a MySQL client connection to the vulnerable Anyquery server running in server mode (e.g., anyquery server --host 0.0.0.0 --port 8070).
  2. The attacker executes a crafted CREATE VIRTUAL TABLE SQL statement using an unrestricted virtual table module like log_reader or json_reader.
  3. The CREATE VIRTUAL TABLE statement includes a maliciously crafted URL pointing to an internal resource, such as http://169.254.169.254/latest/meta-data/ for AWS credentials or http://localhost:8000/admin for an internal web application.
  4. The Anyquery server, via its internal go-getter library, performs an unconstrained HTTP GET request from the server's context to the specified internal or metadata URL.
  5. The Anyquery server receives the HTTP response containing potentially sensitive data from the internal resource.
  6. The attacker executes a SELECT * FROM <virtual_table_name> query against the newly created virtual table.
  7. Anyquery returns the fetched HTTP response content directly as rows within the SQL query result.
  8. The attacker successfully retrieves and exfiltrates sensitive information, such as cloud IAM credentials, internal API responses, or details of the internal network architecture.

Impact

The successful exploitation of CVE-2026-54628 in Anyquery's server mode leads to a high confidentiality impact. Attackers can exfiltrate sensitive internal network data, such as responses from internal REST APIs, and critical cloud credentials (e.g., AWS IAM tokens from metadata services), bypassing external firewall restrictions. This enables unauthorized access to other internal systems and cloud resources. While the integrity impact is rated as low (due to potential interaction with state-changing internal APIs), the primary concern is the unconstrained access to confidential information. The vulnerability has a CVSSv3.1 score of 8.6 (High).

Recommendation

  • Patch CVE-2026-54628 by upgrading Anyquery to version 0.4.5 or later immediately.
  • Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious outbound network connections.
  • Enable network connection logging for the anyquery process to detect attempts to connect to internal or metadata IP addresses.
  • Monitor your DNS and proxy logs for anyquery process activity connecting to 169.254.169.254 (AWS metadata service) and other cloud metadata IPs.
]]>highadvisoryssrfvulnerabilityanyquerylocal-file-readlinuxdata-exfiltration