R2R
Monthly
Unauthenticated SQL injection in SciPhi-AI R2R through version 3.6.6 exposes the application database to blind data exfiltration via the retrieval search endpoint's filter key parameter. The root cause is direct string interpolation of attacker-controlled filter keys into SQL WHERE clauses with no parameterization or escaping, enabling both time-based and boolean-based extraction techniques. A publicly available proof-of-concept exploit exists (VulnCheck, GitHub issue #2308), materially elevating the practical risk beyond the theoretical; no CISA KEV listing at time of analysis.
Unauthenticated stacked SQL injection in SciPhi-AI R2R through version 3.6.6 lets remote attackers execute arbitrary SQL by manipulating the index name parameter of the vector index creation endpoint. Because the index name is interpolated directly into a CREATE INDEX statement and executed under the PostgreSQL superuser account, an attacker can run arbitrary DDL and DML via semicolon-separated statements, fully compromising the backing database. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as being used in active attacks.
Insecure Direct Object Reference in R2R's conversation API through version 3.6.5 enables any authenticated user to modify conversations owned by other users by supplying arbitrary conversation identifiers. The flaw, located in the conversations router (conversations_router.py), bypasses ownership validation in both the conversation update and message append handlers, enabling cross-user data corruption and content injection. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack surface is the network-accessible API layer requiring only a valid authenticated session.
Unauthenticated SQL injection in SciPhi-AI R2R through version 3.6.6 exposes the application database to blind data exfiltration via the retrieval search endpoint's filter key parameter. The root cause is direct string interpolation of attacker-controlled filter keys into SQL WHERE clauses with no parameterization or escaping, enabling both time-based and boolean-based extraction techniques. A publicly available proof-of-concept exploit exists (VulnCheck, GitHub issue #2308), materially elevating the practical risk beyond the theoretical; no CISA KEV listing at time of analysis.
Unauthenticated stacked SQL injection in SciPhi-AI R2R through version 3.6.6 lets remote attackers execute arbitrary SQL by manipulating the index name parameter of the vector index creation endpoint. Because the index name is interpolated directly into a CREATE INDEX statement and executed under the PostgreSQL superuser account, an attacker can run arbitrary DDL and DML via semicolon-separated statements, fully compromising the backing database. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as being used in active attacks.
Insecure Direct Object Reference in R2R's conversation API through version 3.6.5 enables any authenticated user to modify conversations owned by other users by supplying arbitrary conversation identifiers. The flaw, located in the conversations router (conversations_router.py), bypasses ownership validation in both the conversation update and message append handlers, enabling cross-user data corruption and content injection. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack surface is the network-accessible API layer requiring only a valid authenticated session.