6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-44906

CVE-2024-44906: uptrace pgdriver SQL injection vulnerability

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-44906

CVE-2024-44906:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/uptrace/bun	go	<= 1.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2024-44906, is a SQL injection flaw in the uptrace/bun library, specifically within its pgdriver. The root cause, as detailed in the SonarSource blog post "Double Dash, Double Trouble," lies in how negative numeric arguments are interpolated into SQL queries.

The appendArg function in driver/pgdriver/format.go is directly responsible for this. When it processes int64 or float64 arguments, it uses strconv.AppendInt and strconv.AppendFloat respectively. These functions convert numbers to their string representations. If a negative number (e.g., -10) is appended to a query string immediately after a minus operator (e.g., in an expression like value - ?), the resulting SQL can become value - -10. In PostgreSQL and other SQL databases, the sequence -- initiates a line comment. Thus, the query effectively becomes value (or value - depending on spacing rules if any were applied, though the code shows direct concatenation), and the rest of the intended query, including the -10 and any subsequent SQL, is commented out. This allows an attacker to truncate queries and, if other parts of the query or subsequent queries can be influenced, inject arbitrary SQL commands.

The functions formatQuery and formatQueryArgs are higher-level functions that call appendArg to build the final SQL query. Therefore, they are part of the vulnerable call chain. During exploitation, these functions would likely appear in a runtime profile or stack trace as they are involved in processing the user-supplied input and constructing the malformed SQL query.

The GitHub advisory and the linked source code point directly to the appendArg function, and the SonarSource article confirms that pgdriver is unpatched for this type of vulnerability. The evidence from the code shows no special handling (like adding spaces or parentheses around negative numbers) for int64 or general float64 values that would prevent the formation of the -- comment sequence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.