CVE-2023-30625

Deeper analysis

rudder-server, a core component of the open-source RudderStack Customer Data Platform, is affected by a SQL injection vulnerability (CWE-89) in all versions prior to 1.3.0-rc.1. The flaw resides in how the application constructs and executes SQL statements against its PostgreSQL backend, where the default “rudder” database role is granted superuser privileges. The issue carries a CVSS 3.1 base score of 8.8 and can be reached over the network with only low-privileged credentials.

An authenticated attacker can supply crafted input that is concatenated into SQL queries, enabling arbitrary command execution on the underlying PostgreSQL instance. Because the rudder role possesses superuser rights, successful exploitation yields full control of the database server and, by extension, remote code execution on the host operating system.

The project addressed the issue in commit 0d061ff and related patches merged via pull request 2652; administrators are advised to upgrade immediately to version 1.3.0-rc.1 or later. Public exploit code has been published, and the CVE’s EPSS score rose rapidly from a low baseline to a peak of 0.9483 (currently 0.8841), indicating sustained and increasing attacker interest after disclosure.