abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  [email protected]  ·  sqlite-fj-using-auth

sqlite-fj-using-auth

Class: Privilege leftover Reach: Local

SQLite 3.53.4 (b09c88c / SOURCE_ID 2026-07-24 19:02:57 bf7c7f30031888f4e796e429ab3978879485813aaca6f641c7b33e4e09459bcc) - Hwaci

lookupName() rewrites a FULL JOIN USING column to coalesce(...) (TK_FUNCTION). sqlite3AuthRead runs only for TK_COLUMN / TK_TRIGGER, so USING columns never get a SQLITE_READ callback. An embedder that installed sqlite3_set_authorizer and DENY/IGNORE READ on t2.x still returns that column through SELECT x FROM t1 FULL JOIN t2 USING(x).

Authorizer is off on default open. Leftover of that C API. Not RCE. FULL JOIN ON and LEFT JOIN USING stay denied / no leak. Explicit coalesce(t2.x) still authorizes.

ID	no CVE yet
Class	Privilege leftover (column-level authorizer skip)
Reach	Local (embedder sqlite3_set_authorizer; attacker SQL)
CWE	CWE-863, CWE-284
CVSS	High: 7.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Product	SQLite (GitHub mirror sqlite/sqlite)
Affected	3.53.4 (b09c88c14082339b66c7b7158d609a771e64ca69). 3.54-only authorizer FULL JOIN USING fix (2cb2287768) is not on this GA.
Auth	embedder installed sqlite3_set_authorizer; default callback is NULL
License	GNU Affero GPL v3.0
Lab	127.0.0.1:18840 only. Witness string. Not RCE.

What an attacker can do

Against an embedder that installed sqlite3_set_authorizer as column ACL, prepare SELECT x FROM t1 FULL JOIN t2 USING(x) (or NATURAL FULL JOIN). Bare SELECT x FROM t2 is denied (SQLITE_AUTH 23). The FULL JOIN USING form returns the READ-denied column. Zero READ t2.x callbacks fire.

Authorizer is off unless the embedder installs one. Default sqlite3_open is not this leftover. Not RCE.

How I found it

Twenty source hunts of 3.53.4 after PHP. Skip list already named the 3.54 FULL JOIN USING authorizer check-in. It is still missing on latest GA. pExpr->op is TK_FUNCTION at lookupname_end, so the AuthRead gate never runs. WRC_Prune also stops the walker from descending into the coalesce arguments.

lookupname_end:
  if( cnt==1 ){
#ifndef SQLITE_OMIT_AUTHORIZATION
    if( pParse->db->xAuth
     && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER)
    ){
      sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList);
    }
#endif

Wrong turns already recorded: treating authorizer as default-on; expecting LEFT JOIN USING or FULL JOIN ON to leak; expecting explicit coalesce(t2.x) to skip AuthRead; pinning 3.54.0 while it was still draft.

Lab

cd lab
./run.sh

Builds official sqlite-src-3530400 amalgamation. Harness is lab/auth.c. Loopback 127.0.0.1:18840. Authorizer DENY READ t2.x. SELECT x FROM t2 denied. SELECT x FROM t1 FULL JOIN t2 USING(x) returns the witness, 0 READ t2.x. FULL JOIN ON denied. LEFT JOIN USING no leak. IGNORE baseline is NULL; IGNORE FULL JOIN USING still leaks.

SUCCESS sqlite-fj-using-auth how=full-join-using-skip-authread baseline=denied fj-using=witness fj-on=denied left-using=no-leak SQLITE-FJ-USING-AUTH-WITNESS

The fix

Loop sqlite3AuthRead over every pFJMatch child after the coalesce rewrite, the way trunk 2cb2287768 / Git 5694c3bb does for 3.54. Authorizing only a[0] (bbd69ce274) is not enough. LEFT JOIN USING and FULL JOIN ON already authorize; they are not this leftover.

References

• sqlite.org/src tag version-3.53.4 (b09c88c14082339b66c7b7158d609a771e64ca69)
• src/resolve.c lookupName coalesce rewrite and AuthRead gate
• src/auth.c sqlite3AuthRead / sqlite3AuthReadCol
• Forum 2026-07-24T02:52:08Z / 2026-05-31T02:00:37Z