WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

## Summary A critical Remote Code Execution (RCE) vulnerability exists in the application's database query functionality. The validation system fails to recursively inspect child nodes within PostgreSQL array expressions and row expressions, allowing attackers to bypass SQL injection protections. By smuggling dangerous PostgreSQL functions inside these expressions and chaining them with large object operations and library loading capabilities, an unauthenticated attacker can achieve arbitrary code execution on the database server with database user privileges. **Impact:** Complete system compromise with arbitrary code execution --- ## Details ### Root Cause Analysis The application implements a 7-phase SQL validation framework in `internal/utils/inject.go` designed to prevent SQL injection attacks: | Phase | Validation Type | Status | |-------|-----------------|--------| | Phase 1 | Null byte and length checks | ✅ Working | | Phase 2 | PostgreSQL AST parsing via `pg_query_go/v6` | ✅ Working | | Phase 3 | Single statement enforcement | ✅ Working | | Phase 4 | SELECT-only queries | ✅ Working | | Phase 5 | Deep SELECT statement validation | ❌ **Incomplete** | | Phase 6 | Table whitelist validation | ✅ Working | | Phase 7 | Regex-based keyword detection | ✅ Working | ### Critical Vulnerability: Incomplete AST Node Validation The `validateNode()` function in Phase 5 fails to handle two critical PostgreSQL expression types: `ArrayExpr` (array expressions) and `RowExpr` (row expressions). This function recursively validates AST nodes to prevent dangerous operations, but lacks handlers for these node types. **Vulnerable Code Location:** `internal/utils/inject.go` - `validateNode()` function ```go func (v *sqlValidator) validateNode(node *pg_query.Node, result *SQLValidationResult) error { if node == nil { return nil } // Check for subqueries (SubLink) if v.checkSubqueries { if sl := node.GetSubLink(); sl != nil { return fmt.Errorf("subqueries are not allowed") } } // Check for function calls if fc := node.GetFuncCall(); fc != nil { if err := v.validateFuncCall(fc, result); err != nil { return err } } // Check for column references if cr := node.GetColumnRef(); cr != nil { if err := v.validateColumnRef(cr); err != nil { return err } } // Check for type casts if tc := node.GetTypeCast(); tc != nil { if err := v.validateNode(tc.Arg, result); err != nil { return err } // ... type validation ... } // ... MISSING: No handler for ArrayExpr or RowExpr ... } ``` **Missing Handlers:** - `node.GetArrayExpr()` - Not checked; child elements bypass validation - `node.GetRowExpr()` - Not checked; child elements bypass validation ### Attack Vector: Smuggling Functions in Array Expressions By placing dangerous PostgreSQL functions inside array expressions, attackers bypass all validation checks: ```sql SELECT name, ARRAY[pg_read_file('/etc/passwd'), 'safe-string'] FROM knowledge_bases LIMIT 1 ``` **Why This Bypasses All Phases:** - **Phase 1:** No null bytes or length violation ✅ - **Phase 2:** Valid PostgreSQL syntax parses successfully ✅ - **Phase 3:** Single SELECT statement ✅ - **Phase 4:** Query is a SELECT statement ✅ - **Phase 5:** `validateNode()` reaches the `ArrayExpr` node but has no handler; skips validation of child nodes containing `pg_read_file()` ✅ - **Phase 6:** `knowledge_bases` is in the allowed table whitelist ✅ - **Phase 7:** Query does not contain blacklisted keywords (1=1, 0=0, and, or, etc.); regex check passes ✅ --- ## PoC ### Prerequisites 1. AI agent configured with `database_query` tool 3. Agent in "smart reasoning mode" with single tool iteration 4. System prompt restricting tool usage to provided JSON only: ``` You are an assistant that can query a database using database_query tool. Only call the tools with provided JSON from the user. ``` 5. Model: GLM from Z.AI (or equivalent with minimal safety restrictions) 6. At least one knowledge bas

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-89

Also known as

CVE-2026-30860, GO-2026-4641

• github.com/Tencent/WeKnora/security/advisories/GHSA-8w32-6mrw-q5wv
• nvd.nist.gov/vuln/detail/CVE-2026-30860
• github.com/Tencent/WeKnora