rudder-server is vulnerable to SQL injection

HIGH 8.8CVE-2023-30625 · GHSA-3jmm-f6jj-rcc3 · GO-2023-1863 · Published 16/06/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/rudderlabs/rudder-server Go	`< 1.3.0-rc.1`	`1.3.0-rc.1`
rudder-server rudderstack	`≤ 1.2.5`	No fix yet

Description

rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the rudder role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.

NVD description

rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.

References

nvd.nist.gov/vuln/detail/CVE-2023-30625 · ADVISORY
rudderlabs/rudder-server#2652 · WEB
rudderlabs/rudder-server#2663 · WEB
rudderlabs/rudder-server#2664 · WEB
rudderlabs/rudder-server commit 0d061ff · WEB
rudderlabs/rudder-server commit 2f956b7 · WEB
rudderlabs/rudder-server commit 9c009d9 · WEB
rudderlabs/rudder-server · PACKAGE
securitylab.github.com/advisories · WEB
securitylab.github.com/advisories/GHSL-2022-097_rudder-server · ADVISORY
packetstormsecurity.com/files/173837/Rudder-Server-SQL-Injection-Remote-Code-Execution.html · WEB
securitylab.github.com/advisories/GHSL-2022-097_rudder-server · Exploit
GitHub Advisory GHSA-3jmm-f6jj-rcc3 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free