Listen to this Post
Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and `DeleteAllForTenant.cs` reached through IEventStore.DeleteProjectionProgressAsync, while `DictionaryContainsKeyFilter.cs` (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. `Events/Daemon/Internals/EventLoader.cs` contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.
DailyCVE Form:
Platform: Marten
Version: 7.0.0-9.13.0
Vulnerability: SQL Injection
Severity: Critical
date: 2026-09-16
Prediction: 2026-09-23
What Undercode Say:
Primary PoC: dictionary indexer key injection Benign query returns 0 rows x.Attributes["nonexistent-key"] == "v" Attack query returns all rows x.Attributes["nonexistent' = '' or 1=1 --"] == "v"
-- Generated SQL for attack payload select d.data from public.mt_doc_doc as d where d.data -> 'Attributes' ->> 'x' or 1=1 --' = :p0;
// Affected sink locations
// Linq/Members/Dictionaries/DictionaryItemMember.cs — dictionary indexer key (primary, confirmed PoC)
// Linq/Members/Dictionaries/DictionaryContainsKeyFilter.cs — Dictionary.ContainsKey(key) (Newtonsoft serializer only)
// Linq/Parsing/SelectParser.cs — constant string projected through Select(x => new { L = runtimeString })
// Internal/Operations/DeleteAllForTenant.cs — tenant id reaching per-tenant projection teardown via IEventStore.DeleteProjectionProgressAsync
// Schema/DatabaseScopedTenantPartitions.cs — tenant id inlined into FOR VALUES IN ('...') partition DDL
// Events/Daemon/Internals/EventLoader.cs (defense-in-depth) — per-tenant partition-pruning literal
// Fix pattern: escape embedded single quotes
.Replace("'", "''")
// Fix pattern: bind value as parameter
// DeleteAllForTenant uses parameter binding
How Exploit: (Educational Purposes!)
The attacker identifies a Marten application that uses a `Dictionary<,>` indexer key within a LINQ `Where` filter, a common pattern for attribute-based or EAV filtering. The attacker supplies a malicious value containing a single quote, such as nonexistent' = '' or 1=1 --. When Marten generates the SQL query, the single quote breaks out of the string literal, allowing the attacker to inject arbitrary SQL. With ;-batched statements enabled (Npgsql default), the attacker can append data modification commands. The injected query bypasses filter and multi-tenant authorization controls, returning all rows regardless of tenant isolation. Blind data exfiltration is achieved by observing application behavior differences between true and false injected conditions.
Protection: from this CVE
Upgrade Marten to version 9.13.0 or later. Until upgrading, do not pass untrusted input as a dictionary indexer key, `ContainsKey` argument, `Select` constant, or as a tenant id into projection teardown or provisioning. Disable multi-statement command batching to limit blast radius. Apply the fix that escapes embedded single quotes (.Replace("'", "''")) or binds values as parameters in all affected sinks.
Impact:
Successful exploitation allows bypass of filtering and multi-tenant authorization controls, leading to unauthorized data access across tenant boundaries. Blind data exfiltration is possible, allowing attackers to extract sensitive information from the database. In configurations permitting semicolon-batched SQL statements, attackers can modify or delete data. The vulnerability affects confidentiality, integrity, and availability of the Marten-managed PostgreSQL database.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
