{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/julien040/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Anyquery ( \u003c 0.4.5)"],"_cs_severities":["critical"],"_cs_tags":["arbitrary-file-write","rce","anyquery","sqlite","server-mode","vulnerability"],"_cs_type":"advisory","_cs_vendors":["julien040"],"content_html":"\u003cp\u003eA critical vulnerability (CVE-2026-50006) has been identified in Anyquery versions prior to 0.4.5, specifically when the application is operating in \u003ccode\u003eserver\u003c/code\u003e mode. Unauthenticated attackers can leverage this flaw by connecting to the exposed MySQL-compatible server port. The vulnerability stems from Anyquery's failure to restrict SQLite's \u003ccode\u003eATTACH DATABASE\u003c/code\u003e command, allowing adversaries to write arbitrary files to the underlying filesystem. This Arbitrary File Write (AFW) can be exploited to achieve Remote Code Execution (RCE) by dropping malicious files such as PHP web shells into web server directories or injecting cronjob entries into system directories like \u003ccode\u003e/etc/cron.d\u003c/code\u003e. This means an attacker can gain control over the affected system with the privileges of the running Anyquery process, posing a severe threat to data integrity and system availability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker connects to the exposed Anyquery MySQL-compatible server port (e.g., 8070).\u003c/li\u003e\n\u003cli\u003eThe attacker executes an \u003ccode\u003eATTACH DATABASE\u003c/code\u003e SQL command to specify a new SQLite database file and a sensitive target path on the victim's filesystem (e.g., \u003ccode\u003e/etc/cron.d/pwn\u003c/code\u003e or \u003ccode\u003e/var/www/html/shell.php\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker creates a table within the newly attached database using \u003ccode\u003eCREATE TABLE\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker injects a malicious payload (e.g., a reverse shell command for a cronjob, or PHP \u003ccode\u003esystem()\u003c/code\u003e function for a web shell) into the table using an \u003ccode\u003eINSERT INTO\u003c/code\u003e SQL command.\u003c/li\u003e\n\u003cli\u003eAnyquery writes the SQLite database file containing the malicious payload to the specified sensitive path.\u003c/li\u003e\n\u003cli\u003eA system service (e.g., cron daemon, web server) attempts to process the newly created file, ignoring the SQLite binary header and parsing the valid injected malicious code.\u003c/li\u003e\n\u003cli\u003eThe malicious code (e.g., reverse shell, web shell commands) is executed with the privileges of the Anyquery process, leading to Remote Code Execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability carries a CVSS score of 9.1 (Critical), indicating high severity. If exploited, the integrity of the affected system is severely compromised as arbitrary files can be written or overwritten, potentially corrupting critical system data. Availability is also highly impacted, as overwriting essential system files or configurations can lead to a complete Denial of Service (DoS). When Anyquery runs with elevated privileges (e.g., as root) or can write to critical directories like web roots or cronjob folders, the AFW escalates directly to Remote Code Execution (RCE) with a CVSS score of 9.8 (Critical), allowing full system compromise, persistence, and potential privilege escalation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-50006 by upgrading Anyquery to version 0.4.5 or later immediately.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious file creations by the \u003ccode\u003eanyquery\u003c/code\u003e process.\u003c/li\u003e\n\u003cli\u003eEnable \u003ccode\u003efile_event\u003c/code\u003e logging for Linux endpoints to capture file creations in sensitive directories like \u003ccode\u003e/etc/cron.d/\u003c/code\u003e and \u003ccode\u003e/var/www/html/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnable \u003ccode\u003eprocess_creation\u003c/code\u003e logging to monitor for suspicious \u003ccode\u003eanyquery\u003c/code\u003e process command-line arguments, especially \u003ccode\u003e--host 0.0.0.0\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-14T19:16:28Z","date_published":"2026-07-14T19:16:28Z","id":"https://feed.craftedsignal.io/briefs/2026-07-anyquery-afw-rce/","summary":"Anyquery in server mode is vulnerable to arbitrary file write (AFW) due to its failure to restrict native SQLite disk manipulation commands like `ATTACH DATABASE`. Unauthenticated attackers can connect to the MySQL-compatible server port and write arbitrary files (e.g., PHP webshells, malicious cronjobs) to any path writable by the Anyquery process, which can lead to remote code execution (RCE) with the privileges of the Anyquery process, significantly impacting system integrity and availability.","title":"Anyquery Arbitrary File Write (AFW) Leads to Remote Code Execution (RCE)","url":"https://feed.craftedsignal.io/briefs/2026-07-anyquery-afw-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Julien040","version":"https://jsonfeed.org/version/1.1"}