GHSA-rxhg-vcww-2mpw: SQL Injection
Summary
An authenticated user with read access to Activity could influence the ORDER BY clause of the activity list endpoints by supplying an arbitrary sort column:
- GET /api/v1/fleet/activities (ListActivities) - GET /api/v1/fleet/hosts/{id}/activities (ListHostPastActivities)
This originated from the deprecated cursor-pagination helper (appendListOptionsWithCursorToSQL), which interpolated the caller-supplied order key into SQL without an allowlist. The original report's nodekey extraction scenario (/api/v1/fleet/labels/{id}/hosts) was remediated separately in #44385; these two activity endpoints were the residual call sites, neither of which joins the hosts table, so nodekey was never reachable through them.
Impact
Read-only. Because the order key was interpolated, an authenticated user with Activity read could sort by columns not otherwise returned in these responses. The exposure was bounded to columns on activitypast (e.g. details on /api/v1/fleet/activities, which is not in that endpoint's SELECT; host-only activities are already excluded by WHERE hostonly = false). There is no privilege escalation, write access, or reachability of nodekey or other host-join columns through these endpoints.
Remediation
The deprecated helper was removed from the codebase. Both endpoints now pass the caller-supplied sort column through SanitizeColumn, which strips all characters except [\w-.] and backtick-quotes each identifier segment. This closes the injection vector: separators, whitespace, parentheses, and quotes cannot survive sanitization, so an expression-based ORDER BY oracle is not constructable.
Affected versions
< fleet-v4.89.0. Fixed in fleet-v4.89.0.
Credit
Thanks to @axel-corsiez for the report.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/fleetdm/fleet/v4to a version that resolves this vulnerability.Fixed in 4.89.0 - Upgrade
Upgrade
fleetto a version that resolves this vulnerability.Fixed in fleet-v4.89.0
Event History
Frequently Asked Questions
Who could exploit this issue?
An authenticated user must have read access to Activity. Unauthenticated users and users without that permission are not described as able to influence the affected queries.
What information could be exposed through the affected endpoints?
The impact is read-only and limited to columns on the activity_past table that are not normally returned by the activity list response. For example, the fleet activities endpoint could expose the details column through sorting behavior.
Are host node keys exposed through these activity endpoints?
No. Neither residual activity endpoint joins the hosts table, so node_key is not reachable through them. Host-only activities are also excluded from the fleet activities endpoint by the host_only = false condition.