Press enter or click to view image in full size
When a 24-hour research window turned into a 7-step RCE chain, we found that PostHog’s SSRF, a ClickHouse 0day, and default PostgreSQL credentials were the perfect storm for a full remote code execution.
A deep dive into how overlooked validations, a SQL escaping bug, and static credentials turned a simple webhook into a full system compromise.
Source: Mehmet Ince @mdisec — Source link
Highlights
Press enter or click to view image in full size
Key points
- PostHog’s webhook save endpoint bypassed SSRF validations applied during testing.
- The Rust webhook worker followed HTTP redirects, allowing POST to GET conversion for ClickHouse access.
- ClickHouse table functions accepted user input that was improperly escaped for PostgreSQL queries.
- Dollar quoting ($$) bypassed ClickHouse’s backslash escaping, enabling SQL injection into PostgreSQL.
- Static Docker names and default PostgreSQL credentials formed the final pivot point.
- The chain culminated in a reverse shell via COPY FROM PROGRAM on the PostgreSQL…