Sciphi Ai
Monthly
Unauthenticated SQL injection in SciPhi-AI R2R through version 3.6.6 exposes the application database to blind data exfiltration via the retrieval search endpoint's filter key parameter. The root cause is direct string interpolation of attacker-controlled filter keys into SQL WHERE clauses with no parameterization or escaping, enabling both time-based and boolean-based extraction techniques. A publicly available proof-of-concept exploit exists (VulnCheck, GitHub issue #2308), materially elevating the practical risk beyond the theoretical; no CISA KEV listing at time of analysis.
Unauthenticated stacked SQL injection in SciPhi-AI R2R through version 3.6.6 lets remote attackers execute arbitrary SQL by manipulating the index name parameter of the vector index creation endpoint. Because the index name is interpolated directly into a CREATE INDEX statement and executed under the PostgreSQL superuser account, an attacker can run arbitrary DDL and DML via semicolon-separated statements, fully compromising the backing database. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as being used in active attacks.
Insecure Direct Object Reference in R2R's conversation API through version 3.6.5 enables any authenticated user to modify conversations owned by other users by supplying arbitrary conversation identifiers. The flaw, located in the conversations router (conversations_router.py), bypasses ownership validation in both the conversation update and message append handlers, enabling cross-user data corruption and content injection. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack surface is the network-accessible API layer requiring only a valid authenticated session.
Unauthenticated remote attackers can exploit a server-side request forgery (SSRF) in SciPhi-AI R2R 3.6.6 and earlier by supplying a crafted generation_config.api_base value to the Retrieval Completion API endpoint, causing the server to make requests to arbitrary internal or attacker-controlled URLs. Publicly available exploit code exists (a GitHub Gist), and the vendor did not respond to disclosure, so no patched version is confirmed at time of analysis. The independent assessment rates this as medium severity (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; VulDB CVSS 4.0 score 6.9), with impact bounded by what internal targets the R2R server can reach.
Hard-coded JWT signing secrets in SciPhi-AI R2R through 3.6.6 can let remote unauthenticated attackers forge valid JSON Web Tokens and bypass authentication when a deployment still uses the shipped DEFAULT_BCRYPT_SECRET_KEY or DEFAULT_NACL_SECRET_KEY values. The exposure is configuration-dependent: instances that override both defaults with custom secrets are not vulnerable, and the authentication or API endpoints must be reachable over the network for exploitation. Publicly available exploit code exists via the linked disclosure, but there is no KEV confirmation of active exploitation.
Unauthenticated SQL injection in SciPhi-AI R2R through version 3.6.6 exposes the application database to blind data exfiltration via the retrieval search endpoint's filter key parameter. The root cause is direct string interpolation of attacker-controlled filter keys into SQL WHERE clauses with no parameterization or escaping, enabling both time-based and boolean-based extraction techniques. A publicly available proof-of-concept exploit exists (VulnCheck, GitHub issue #2308), materially elevating the practical risk beyond the theoretical; no CISA KEV listing at time of analysis.
Unauthenticated stacked SQL injection in SciPhi-AI R2R through version 3.6.6 lets remote attackers execute arbitrary SQL by manipulating the index name parameter of the vector index creation endpoint. Because the index name is interpolated directly into a CREATE INDEX statement and executed under the PostgreSQL superuser account, an attacker can run arbitrary DDL and DML via semicolon-separated statements, fully compromising the backing database. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as being used in active attacks.
Insecure Direct Object Reference in R2R's conversation API through version 3.6.5 enables any authenticated user to modify conversations owned by other users by supplying arbitrary conversation identifiers. The flaw, located in the conversations router (conversations_router.py), bypasses ownership validation in both the conversation update and message append handlers, enabling cross-user data corruption and content injection. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack surface is the network-accessible API layer requiring only a valid authenticated session.
Unauthenticated remote attackers can exploit a server-side request forgery (SSRF) in SciPhi-AI R2R 3.6.6 and earlier by supplying a crafted generation_config.api_base value to the Retrieval Completion API endpoint, causing the server to make requests to arbitrary internal or attacker-controlled URLs. Publicly available exploit code exists (a GitHub Gist), and the vendor did not respond to disclosure, so no patched version is confirmed at time of analysis. The independent assessment rates this as medium severity (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; VulDB CVSS 4.0 score 6.9), with impact bounded by what internal targets the R2R server can reach.
Hard-coded JWT signing secrets in SciPhi-AI R2R through 3.6.6 can let remote unauthenticated attackers forge valid JSON Web Tokens and bypass authentication when a deployment still uses the shipped DEFAULT_BCRYPT_SECRET_KEY or DEFAULT_NACL_SECRET_KEY values. The exposure is configuration-dependent: instances that override both defaults with custom secrets are not vulnerable, and the authentication or API endpoints must be reachable over the network for exploitation. Publicly available exploit code exists via the linked disclosure, but there is no KEV confirmation of active exploitation.