wtfse
Re:Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Cr...
on Thursday December 18, 2025 @08:57AM (#46312709)
That being said, having the ability to send HTTP requests to the internal servers is usually not critical vulnerability. Therefore having Clickhouse low-severity escaping vulnerability actually lead the whole chain to reach code execution. All the other services were requiring me to send special headers, which is not possible most of the SSRF cases :(
Re:Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Cr...
on Thursday December 18, 2025 @08:48AM (#46312577)
I'm glad you liked it mate.
Re:Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Cr...
on Thursday December 18, 2025 @08:48AM (#46312573)
hey this is the author. Thanks for everyones comment here guys.
There as a actually a vulnerability Clickhouse, which helps you to execute any query on the remote postgresl. By default, you can't execute any random query! This bug was seperately reported to the Clickhouse and has been fixed seperately https://github.com/ClickHouse/ClickHouse/pull/74144/commits/...
Re:Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Cr...
on Thursday December 18, 2025 @08:45AM (#46312549)
All of these vulnerabilities accepted by ZDI.Feel free to search the following codes. ZDI-CAN-25351. ZDI-CAN-25352. ZDI-CAN-25350. ZDI-CAN-25358.
Re:Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Cr...
on Thursday December 18, 2025 @08:44AM (#46312534)
hi, this is the author of the article. Thanks for the feedback mate. fixed it.