CVE-2024-41672: 
DuckDB vulnerability analysis and mitigation

DuckDB versions 1.0.0 and prior contain a vulnerability (CVE-2024-41672) where content in the filesystem is accessible for reading using sniff_csv, even when enable_external_access=false is set. The vulnerability was discovered in July 2024 and has been fixed in version 1.1.0 (GitHub Advisory).

The vulnerability allows attackers to bypass filesystem access restrictions through the sniff_csv function, even when external access is explicitly disabled. The issue has a CVSS v3.1 Base Score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact with network accessibility (NVD).

The vulnerability presents two main impact vectors: First, it allows access to files that should be restricted when external access is disabled. Second, it enables reading content from system files (such as /etc/hosts, proc/self/environ) that shouldn't be accessible through the sniff_csv function, which is intended only to provide information about data shape (GitHub Advisory).

The vulnerability can be exploited by using the sniff_csv function to read system files even when enable_external_access=false is set. A proof of concept demonstrates this by accessing /proc/self/environ using the command: SELECT Columns FROM sniff_csv('/proc/self/environ') (GitHub Advisory).

A temporary workaround is available by disabling the local file system using the disabled_filesystems setting: SET disabled_filesystems='LocalFileSystem'. The permanent fix has been implemented in version 1.1.0 through commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a (GitHub Commit).