Chartbrew versions prior to 5.2.3 contain a critical SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands and potentially access sensitive data.

This is an SQL injection vulnerability (CWE-89) stemming from the improper neutralization of special elements within the ClickHouse protocol handler. Because the application fails to enable the escapeBackslash option when processing SQL variables, an unauthenticated attacker can manipulate database queries to bypass intended restrictions.

Successful exploitation of this flaw can lead to severe consequences, including the unauthorized disclosure of sensitive information, modification of database contents, and potential compromise of internal network resources. Given the CVSS score of 7.9, this vulnerability represents a high risk, particularly for organizations using Chartbrew to visualize data from production databases. The ability for unauthenticated users to trigger this via public dashboards significantly expands the attack surface.

Immediate Action: Upgrade Chartbrew to version 5.2.3 or later to apply the necessary security fixes in the ClickHouse protocol handler.

Proactive Monitoring: Review application and database logs for unusual SQL patterns, unexpected query syntax, or signs of unauthorized data access attempts originating from public-facing dashboards.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting backslash and quote manipulation sequences.

Public Exploit Available: No (There is no confirmed public exploit or proof-of-concept available at this time).

The vulnerability in Chartbrew is significant due to the ease of exploitation by unauthenticated actors. Administrators must prioritize updating to version 5.2.3 immediately to eliminate the risk of arbitrary SQL execution. Organizations that cannot update immediately should consider restricting access to dashboards or disabling ClickHouse-backed charts until the patch is applied.