Anyquery - CraftedSignal Threat Feed

Anyquery Server-Side Request Forgery via Unrestricted SQLite Virtual Table Modules

hello@craftedsignal.io — Tue, 14 Jul 2026 20:39:43 +0000

Anyquery, a tool for querying various data sources, contains a critical Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-54628, in its server mode. When anyquery server is launched, it exposes a MySQL-compatible interface. Versions prior to 0.4.5 allow unauthenticated attackers to create dynamic virtual tables using modules such as json_reader or log_reader. These modules leverage go-getter to fetch URLs without restricting access to local (127.0.0.0/8), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or cloud metadata (169.254.169.254) IP addresses. This allows attackers to bypass network segmentation, scan internal ports, interact with internal APIs, and exfiltrate cloud credentials (e.g., AWS IAM tokens) from the underlying host. The vulnerability poses a significant risk to the confidentiality of internal network data and cloud environments.

Attack Chain

An unauthenticated attacker initiates a MySQL client connection to the vulnerable Anyquery server running in server mode (e.g., anyquery server --host 0.0.0.0 --port 8070).
The attacker executes a crafted CREATE VIRTUAL TABLE SQL statement using an unrestricted virtual table module like log_reader or json_reader.
The CREATE VIRTUAL TABLE statement includes a maliciously crafted URL pointing to an internal resource, such as http://169.254.169.254/latest/meta-data/ for AWS credentials or http://localhost:8000/admin for an internal web application.
The Anyquery server, via its internal go-getter library, performs an unconstrained HTTP GET request from the server's context to the specified internal or metadata URL.
The Anyquery server receives the HTTP response containing potentially sensitive data from the internal resource.
The attacker executes a SELECT * FROM query against the newly created virtual table.
Anyquery returns the fetched HTTP response content directly as rows within the SQL query result.
The attacker successfully retrieves and exfiltrates sensitive information, such as cloud IAM credentials, internal API responses, or details of the internal network architecture.

Impact

The successful exploitation of CVE-2026-54628 in Anyquery's server mode leads to a high confidentiality impact. Attackers can exfiltrate sensitive internal network data, such as responses from internal REST APIs, and critical cloud credentials (e.g., AWS IAM tokens from metadata services), bypassing external firewall restrictions. This enables unauthorized access to other internal systems and cloud resources. While the integrity impact is rated as low (due to potential interaction with state-changing internal APIs), the primary concern is the unconstrained access to confidential information. The vulnerability has a CVSSv3.1 score of 8.6 (High).

Recommendation

Patch CVE-2026-54628 by upgrading Anyquery to version 0.4.5 or later immediately.
Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious outbound network connections.
Enable network connection logging for the anyquery process to detect attempts to connect to internal or metadata IP addresses.
Monitor your DNS and proxy logs for anyquery process activity connecting to 169.254.169.254 (AWS metadata service) and other cloud metadata IPs.

Anyquery Arbitrary File Write (AFW) Leads to Remote Code Execution (RCE)

hello@craftedsignal.io — Tue, 14 Jul 2026 19:16:28 +0000

A critical vulnerability (CVE-2026-50006) has been identified in Anyquery versions prior to 0.4.5, specifically when the application is operating in server mode. Unauthenticated attackers can leverage this flaw by connecting to the exposed MySQL-compatible server port. The vulnerability stems from Anyquery's failure to restrict SQLite's ATTACH DATABASE command, allowing adversaries to write arbitrary files to the underlying filesystem. This Arbitrary File Write (AFW) can be exploited to achieve Remote Code Execution (RCE) by dropping malicious files such as PHP web shells into web server directories or injecting cronjob entries into system directories like /etc/cron.d. This means an attacker can gain control over the affected system with the privileges of the running Anyquery process, posing a severe threat to data integrity and system availability.

Attack Chain

An unauthenticated attacker connects to the exposed Anyquery MySQL-compatible server port (e.g., 8070).
The attacker executes an ATTACH DATABASE SQL command to specify a new SQLite database file and a sensitive target path on the victim's filesystem (e.g., /etc/cron.d/pwn or /var/www/html/shell.php).
The attacker creates a table within the newly attached database using CREATE TABLE.
The attacker injects a malicious payload (e.g., a reverse shell command for a cronjob, or PHP system() function for a web shell) into the table using an INSERT INTO SQL command.
Anyquery writes the SQLite database file containing the malicious payload to the specified sensitive path.
A system service (e.g., cron daemon, web server) attempts to process the newly created file, ignoring the SQLite binary header and parsing the valid injected malicious code.
The malicious code (e.g., reverse shell, web shell commands) is executed with the privileges of the Anyquery process, leading to Remote Code Execution.

Impact

This vulnerability carries a CVSS score of 9.1 (Critical), indicating high severity. If exploited, the integrity of the affected system is severely compromised as arbitrary files can be written or overwritten, potentially corrupting critical system data. Availability is also highly impacted, as overwriting essential system files or configurations can lead to a complete Denial of Service (DoS). When Anyquery runs with elevated privileges (e.g., as root) or can write to critical directories like web roots or cronjob folders, the AFW escalates directly to Remote Code Execution (RCE) with a CVSS score of 9.8 (Critical), allowing full system compromise, persistence, and potential privilege escalation.

Recommendation

Patch CVE-2026-50006 by upgrading Anyquery to version 0.4.5 or later immediately.
Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious file creations by the anyquery process.
Enable file_event logging for Linux endpoints to capture file creations in sensitive directories like /etc/cron.d/ and /var/www/html/.
Enable process_creation logging to monitor for suspicious anyquery process command-line arguments, especially --host 0.0.0.0.