A critical authorization bypass vulnerability in Manticore Search allows authenticated users to escalate privileges and gain full administrative control over the database.

The vulnerability exists in the SQL authorization layer, which only performs permission checks on the first statement of a multi-statement request. A low-privileged authenticated user can append malicious SQL statements to a legitimate query to bypass these checks and read sensitive internal system tables, including those storing user credentials and hashes.

Successful exploitation allows an attacker to dump the system.auth_users table and extract password hashes. Because the system uses these hashes directly for challenge-response authentication, an attacker can perform a pass-the-hash attack to impersonate any user, including administrators, without needing to crack the passwords. This results in total loss of confidentiality and integrity, providing the attacker with persistent administrative access to the search infrastructure.

Immediate Action: Update Manticore Search to version 28.4.4 or later immediately.

Proactive Monitoring: Review database access logs for unusual multi-statement queries, particularly those containing semicolon-delimited SELECT statements targeting system.auth_users or other internal tables.

Compensating Controls: If immediate patching is not possible, restrict database access to trusted network segments and disable multi-statement query support at the application or proxy layer if feasible.

Public Exploit Available: Yes, a detailed technical write-up containing attack methodology and proof-of-concept information is available via the researcher's GitHub repository.

This is a high-severity vulnerability that effectively renders the instance's internal authentication and authorization controls useless. Given the availability of technical details and the ease with which an attacker can escalate to full administrative privileges, organizations must prioritize upgrading to version 28.4.4 to eliminate the flaw. Ensure that all administrative credentials are rotated if there is any suspicion that the instance has been accessed by unauthorized parties.