Listen to this Post
This vulnerability resides in Fleet’s activity list endpoints. An authenticated user with read access to Activity could manipulate the `ORDER BY` clause of the SQL query by supplying an arbitrary sort column. The vulnerable endpoints are:
– `GET /api/v1/fleet/activities` (ListActivities)
– `GET /api/v1/fleet/hosts/{id}/activities` (ListHostPastActivities)
The root cause traces back to a deprecated cursor-pagination helper function, appendListOptionsWithCursorToSQL. This helper interpolated the user-supplied `order_key` directly into the SQL query without any allowlist or sanitization. A prior report concerning `node_key` extraction via the `/api/v1/fleet/labels/{id}/hosts` endpoint was already addressed separately. The activity endpoints were the remaining call sites still using this flawed helper.
The vulnerability is limited in scope. Since these endpoints do not join the `hosts` table, the `node_key` column was never reachable. An attacker could only sort by columns present in the `activity_past` table. The impact is strictly read-only; there is no privilege escalation or write access. The exposure is further limited because host-only activities are excluded by the `WHERE host_only = false` clause.
The fix involved removing the deprecated helper entirely. Both endpoints now route the sort column through a `SanitizeColumn` function. This function strips all characters except `[\w-.]` and safely backtick-quotes each identifier segment. This prevents the construction of expression-based `ORDER BY` oracles by eliminating separators, whitespace, parentheses, and quotes.
The vulnerability affects all versions before `fleet-v4.89.0` and is fixed in fleet-v4.89.0. The report was credited to @axel-corsiez.
DailyCVE Form:
Platform: Fleet (FleetDM)
Version: < v4.89.0
Vulnerability: ORDER BY Injection
Severity: Low
Date: 2026-08-11
Prediction: Already Patched (v4.89.0)
What Undercode Say:
The vulnerability stems from insecure concatenation of user input into SQL `ORDER BY` clauses. The following illustrates the insecure pattern that was present:
Insecure concept (simplified) order_key = "details" (user-supplied) query = "SELECT FROM activity_past ORDER BY " + order_key Result: SELECT FROM activity_past ORDER BY details
The fix implements strict sanitization:
Sanitized concept order_key = SanitizeColumn(user_input) Strips all but [\w-.] query = "SELECT FROM activity_past ORDER BY <code>" + order_key + "</code>" Result: SELECT FROM activity_past ORDER BY `details`
Exploit: (Educational Purposes!)
An attacker with read access to Activity could exploit this by sending a crafted request to the vulnerable endpoints:
Exploit attempt to sort by a non-returned column curl -X GET "https://fleet-server.example.com/api/v1/fleet/activities?order_key=details" \ -H "Authorization: Bearer <valid_user_token>" Attempt to inject SQL (mitigated in patched version) curl -X GET "https://fleet-server.example.com/api/v1/fleet/activities?order_key=details; DROP TABLE users;--" \ -H "Authorization: Bearer <valid_user_token>"
The injection attempt would not work in the patched version due to the `SanitizeColumn` filter.
Protection:
Upgrade to Fleet version `v4.89.0` or later. If an immediate upgrade is not possible, restrict access to the vulnerable endpoints to trusted users only. The fix removes the deprecated helper and applies `SanitizeColumn` to all user-supplied sort columns.
Impact:
- Confidentiality: Low. An attacker could sort by columns not normally returned in the API response, potentially revealing information about the structure of the `activity_past` table.
- Integrity: None. The vulnerability does not allow modification of data.
- Availability: None. The vulnerability does not cause service disruption.
- Scope: The attack vector is limited to the `activity_past` table columns. The `hosts` table and sensitive fields like `node_key` are not reachable.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
