An unauthenticated server-side request forgery vulnerability in Anyquery allows attackers to probe internal networks and exfiltrate sensitive cloud metadata or credentials.

The vulnerability exists because the Anyquery MySQL-compatible server port exposes URL-capable SQLite virtual table modules, such as json_reader and log_reader, without validating outbound destinations. An unauthenticated attacker can force the server to fetch resources from loopback or private internal addresses, effectively acting as a confused deputy to bypass network boundaries.

The exploitation of this vulnerability poses a severe risk to organizational security, as it enables attackers to perform internal network reconnaissance, access internal APIs, and steal cloud service credentials. With a CVSS score of 8.6, this flaw is classified as high severity, reflecting the potential for significant data exposure and unauthorized access to infrastructure that is typically protected by perimeter defenses.

Immediate Action: Upgrade to Anyquery version 0.4.5 or later to resolve this vulnerability and restrict outbound request capabilities.

Proactive Monitoring: Review server access logs for unusual SQL queries targeting loopback addresses (127.0.0.1) or internal cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Implement strict egress filtering on the host running the Anyquery process to block traffic to private network ranges and cloud metadata services.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for direct exfiltration of cloud credentials, this vulnerability should be prioritized for remediation. Organizations currently running Anyquery must update to version 0.4.5 immediately to prevent unauthorized access to their internal infrastructure and cloud environments.