CVE-2026-71282 PUBLISHED

ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

Assigner: TuranSec
Reserved: 05.08.2026 Published: 05.08.2026 Updated: 05.08.2026

ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count() and list()) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format!() macro (dsl::sql::<Bool>(&format!("device.tags->>'{}' =", k)).bind::<Text, _>(v)), while only the tag VALUE is safely parameter-bound via Diesel's .bind(). An authenticated user with device-list access can inject SQL via a crafted tag key when the SQLite backend (chirpstack-sqlite package) is in use; the PostgreSQL backend is unaffected as it uses Diesel's native JSONB containment operator instead of raw SQL string formatting.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Product Status

Vendor chirpstack
Product chirpstack
Versions Default: unaffected
  • affected from 0 to 4.19.0-test.5 (incl.)

Credits

  • Alibek Baxtiyorov finder

References

Problem Types

  • CWE-89 CWE