EUVD-2026-94522
GHSA-f46q-3v67-fmm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain JWT or exploit empty-secret bypass
-
DeliveryPOST crafted rawquery to /api/v4/statistics/query
-
ExploitUnvalidated SQL reaches DuckDB/FlightSQL backend
-
ExecutionEnumerate schema and dump hep records
-
ImpactExfiltrate VoIP call data and SIP metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending a POST request to the /api/v4/statistics/query endpoint with a JSON body containing param.query[].rawquery, which the V4StatisticsQuery handler forwards to the DuckDB/FlightSQL backend without the sqlvalidator.ValidateRawSQL() neutralization applied on every other handler. The endpoint sits in the JWT-protected group, so a valid JWT (any authenticated user, PR:L) is normally required - this is the primary limiting factor. However, on default deployments the JWT secret is empty, which the vendor states collapses JWT enforcement and makes the flaw reachable without credentials. No special non-default feature toggle, user interaction, or platform-specific condition is needed beyond a running Homer coordinator exposing the v4 statistics API; the only hardening that meaningfully limits exposure is setting a strong coordinator.jwt.secret (addressed in the same fix series) and upgrading to 11.0.283+. |
| Impact | This is a genuinely high-priority flaw for any Homer deployment, though real-world risk hinges on configuration. The confirmed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity attack requiring only a low-privileged authenticated account, yielding high confidentiality and integrity impact. The decisive amplifier is the vendor-stated authentication bypass: on default deployments the JWT secret is empty, so the 'protected' JWT requirement collapses and the PR:L precondition effectively drops to PR:N, making this exploitable pre-authentication - this is why the tag set includes 'Authentication Bypass.' No EPSS score, CISA KEV listing, or SSVC decision data was provided, so automatable/exploitation-maturity signals cannot be quantified; absence of KEV should not be read as absence of risk here. A working PoC (curl commands exfiltrating information_schema.tables and the hep call-record table) is published directly in the GitHub Security Advisory, so publicly available exploit code exists even though active in-the-wild exploitation is not confirmed. Net: real priority for Homer operators, especially those on default/unhardened JWT configurations, bounded mainly by the product's niche footprint rather than by exploit difficulty. |
| Exploit ScenarioDerived | An attacker with any low-privileged Homer account (or no credentials at all on a default deployment where the JWT secret is empty) sends a POST to /api/v4/statistics/query with a crafted rawquery field such as 'SELECT * FROM hep LIMIT 1000'. Because the V4StatisticsQuery handler omits the sqlvalidator.ValidateRawSQL check used elsewhere, the raw SQL is passed verbatim to the DuckDB/FlightSQL backend, dumping all stored VoIP call records, SIP messages, and metadata. A published PoC in the GitHub advisory demonstrates this exact request, and DuckDB INSTALL/LOAD statements are also accepted, enabling extension-based exfiltration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
SQL injection in the Homer coordinator's POST /api/v4/statistics/query endpoint allows a remote attacker to execute arbitrary DuckDB SQL against the FlightSQL backend, exposing or altering all stored VoIP call records, SIP messages and metadata. The V4StatisticsQuery handler forwards the caller-supplied rawquery field verbatim to DuckDB without the sqlvalidator.ValidateRawSQL() neutralization applied in sibling handlers, so any authenticated user is sufficient (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1); the vendor notes that on default deployments an empty JWT secret collapses this to pre-authentication reachability. Publicly available exploit code exists (the advisory ships a working curl PoC, and DuckDB INSTALL/LOAD is reachable for extension-based exfiltration); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
RemediationAI
Vendor-released patch: upgrade the Homer coordinator to version 11.0.283 or later - the fix is commit a7d027dc684b210b62285c49f555ac88d64f35f0 delivered via PR https://github.com/sipcapture/homer/pull/837 - which restores the sqlvalidator.ValidateRawSQL() call ahead of h.flightService.Query() and consequently restricts the rawquery field to read-only SQL. Because the same change series removes the well-known default admin bootstrap credential and auto-generates a JWT secret, the upgrade also closes the adjacent condition that makes this flaw pre-authentication; if you cannot upgrade immediately, explicitly set a strong random coordinator.jwt.secret (or HOMER_COORDINATOR_JWT_SECRET) of at least 32 characters so the /api/v4/statistics/query endpoint genuinely requires a JWT - the trade-off is that this only restores the PR:L prerequisite and does not stop an authenticated low-privilege user from dumping the hep table. As a compensating control, block or rate-limit POST /api/v4/statistics/query at the reverse proxy or firewall for all non-administrative clients, accepting that this disables v4 statistics queries for legitimate dashboards, and restrict outbound network access from the coordinator host so DuckDB INSTALL/LOAD cannot be used to fetch and execute external extensions. Rotate any JWT secrets and administrative credentials that may have been exposed through the SQL injection path, and review coordinator logs for anomalous rawquery payloads referencing information_schema, hep, or INSTALL/LOAD. Advisory references: https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4 and https://github.com/sipcapture/homer/releases/tag/11.0.283.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Homer (sipcapture) is a SIP/VoIP capture and monitoring platform whose Go-based coordinator (CPE pkg:go/github.com_sipcapture_homer-app) brokers queries to a DuckDB backend over the Apache Arrow FlightSQL protocol. The vulnerable code path is coordinator/handlers/statistics_v4.go (lines 74-107), where the Echo handler binds the request body into a V4StatisticsQuery model and passes query.RawQuery directly into h.flightService.Query() with no validation step. Every comparable handler - search.go (line 194) and transactions_v4.go - first calls sqlvalidator.ValidateRawSQL() and returns HTTP 400 on rejection, so this is a classic missing-control regression rather than an unknown parsing flaw. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): because rawquery is interpolated as the full SQL statement text rather than as a bound parameter, the semantic distinction between query and statement disappears, and the attacker inherits the full privileges of the FlightSQL/DuckDB service account. That includes reading information_schema.tables, dumping the hep table of call records, and invoking DuckDB's INSTALL/LOAD extension machinery. The handler sits inside the JWT-protected route group, but the same fix series also hardens the default empty coordinator.jwt.secret, meaning unhardened deployments effectively expose the endpoint pre-authentication.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network endpoint with arbitrary SQL, low complexity, requires a low-privileged authenticated account (PR:L, honoring JWT-protected group), giving full read and write (C:H/I:H) over backend data; availability impact not demonstrated.
Primary rating from Vendor (https://github.com/sipcapture/homer).
CVSS VectorVendor: https://github.com/sipcapture/homer
DescriptionCVE.org
Summary
The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service.
Details
coordinator/handlers/statistics_v4.go lines 74-107 - V4StatisticsQuery:
query := &model.V4StatisticsQuery{}
if err = c.Bind(query); err != nil { ... }
// No ValidateRawSQL call here - contrast with other handlers:
results, err := h.flightService.Query(c.Request().Context(), query.RawQuery)Contrast with coordinator/handlers/search.go line 194 - secure pattern not followed:
if err := sqlvalidator.ValidateRawSQL(rawQuery); err != nil {
return c.JSON(http.StatusBadRequest, ...)
}query.RawQuery is whatever the caller submitted; it is passed verbatim to the FlightSQL/DuckDB backend. The handler is registered under the protected group (requires JWT), but given that the default JWT secret is empty (see related advisory), this is effectively pre-authentication on a default deployment.
PoC
# With a valid JWT (or empty JWT secret bypass):
curl -s -X POST http://<homer-host>/api/v4/statistics/query \
-H "Authorization: Bearer <jwt>" \
-H "Content-Type: application/json" \
-d '{
"param": {
"query": [{"rawquery": "SELECT * FROM information_schema.tables"}]
}
}'
# Returns all table names accessible to the DuckDB FlightSQL service
# Exfiltrate all stored call records:
# "rawquery": "SELECT * FROM hep LIMIT 1000"
# Arbitrary DuckDB SQL is accepted including INSTALL/LOAD for extension-based exfiltrationImpact
SQL Injection / Improper Neutralization of Special Elements (CWE-89). Any authenticated user can execute arbitrary SQL against all data accessible to the FlightSQL/DuckDB backend - including all stored VoIP call records, SIP messages, and metadata. Combined with the authentication bypass when JWT secret is empty, this is exploitable without credentials.
Fix
Apply sqlvalidator.ValidateRawSQL() to query.RawQuery before passing it to h.flightService.Query(), matching the pattern already used in search.go and transactions_v4.go.
If possible, please apply for a CVE number when posting.
Technical POC Analysis
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A HIGH-severity SQL injection flaw (CVE-2026-62251, CVSS 8.1) in the Homer coordinator's statistics query API allows an attacker to run arbitrary database commands against the FlightSQL backend, potentially reading or altering the organization's entire store of VoIP call records, SIP messages, and associated metadata. Because access requires only a valid user account - and on default deployments the vendor warns an unconfigured JWT secret removes even that barrier - the exposure extends well beyond the coordinator itself to the communications records of every monitored user and customer. Leadership should treat this as a data-confidentiality and communications-records integrity event with likely regulatory and privacy notification implications, not merely a technical bug.
Apply vendor patch. Until it is deployed, set a strong, non-default JWT secret to close the pre-authentication path, restrict network access to the coordinator and FlightSQL backend, and rotate credentials and review logs for anomalous query activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB