8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33142

CVE-2026-33142: OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to three other query construction paths in StatementGenerator. The toSortStatement, toSelectStatement, and toGroupByStatement methods accept user-controlled object keys from API request bodies and interpolate them as ClickHouse Identifier parameters without verifying they correspond to actual model columns. ClickHouse Identifier parameters are substituted directly into queries without escaping, so an attacker who can reach any analytics list or aggregate endpoint can inject arbitrary SQL through crafted sort, select, or groupBy keys. This issue has been patched in version 10.0.34.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33142

CVE-2026-33142:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
oneuptime	npm	< 10.0.34	10.0.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the oneuptime application, specifically within the StatementGenerator.ts file, which is responsible for building ClickHouse database queries for analytics. The core issue is a failure to validate user-supplied input that is used to construct SQL queries, leading to SQL injection.

The advisory and the patch reveal that three methods in the StatementGenerator class were vulnerable: toGroupByStatement, toSortStatement, and toSelectStatement. These methods accept groupBy, sort, and select objects, respectively, which are derived directly from the request body of API endpoints like BaseAnalyticsAPI.getList() and BaseAnalyticsAPI.getAggregate(). The keys of these objects were used as column identifiers in the generated ClickHouse SQL queries.

ClickHouse's Identifier parameters are substituted directly into the query without escaping. The vulnerable methods were using these user-controlled keys as Identifier parameters without first checking if they were legitimate column names. This allowed an attacker to craft request bodies with malicious SQL snippets as keys in the groupBy, sort, or select JSON objects, which would then be executed by the database.

The patch addresses this by adding a validation step in each of the three vulnerable functions. It uses this.model.getTableColumn(key) to verify that the key corresponds to a valid column in the data model before it is used in the SQL statement. If the key is not a valid column, a BadDataException is thrown, preventing the injection.

Vulnerable functions

StatementGenerator.toGroupByStatement

Common/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

This function constructs a GROUP BY clause for a ClickHouse SQL query. Before the patch, it iterated through user-provided keys from the `groupBy` object and used them directly as column identifiers in the SQL query without validation. This allowed an attacker to inject arbitrary SQL by providing a crafted key, leading to SQL injection.

StatementGenerator.toSortStatement

Common/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

This function constructs an ORDER BY clause for a ClickHouse SQL query. Before the patch, it iterated through user-provided keys from the `sort` object and used them directly as column identifiers in the SQL query without validation. This allowed an attacker to inject arbitrary SQL by providing a crafted key, leading to SQL injection.

StatementGenerator.toSelectStatement

Common/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

This function constructs the SELECT part of a ClickHouse SQL query. Before the patch, it iterated through user-provided keys from the `select` object and used them directly as column identifiers in the SQL query without validation. This allowed an attacker to inject arbitrary SQL by providing a crafted key, leading to SQL injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.