Vulnerability in DuckDB Allowing Access to Filesystem Even with 'Enable External Access' Disabled

CVE-2024-41672

What is CVE-2024-41672?

A vulnerability exists in the DuckDB SQL database management system that allows unauthorized reading of filesystem content through the sniff_csv function. This issue permits attackers to access files that should be restricted, including sensitive files like /etc/hosts and proc/self/environ. Even when the enable_external_access feature is set to false, the function exposes filesystem content, potentially leading to data leaks and security breaches. A fix has been identified and will be included in the upcoming version 1.1.0.

References