abraxas/sqlite-xfer-authSQLite 3.53.4 - High - Local - Privilege leftover - INSERT SELECT xfer skips source READ
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · sqlite-xfer-auth
Class: Privilege leftover Reach: Local
SQLite 3.53.4 (b09c88c, SOURCE_ID 2026-07-24 19:02:57 bf7c7f30031888f4e796e429ab3978879485813aaca6f641c7b33e4e09459bcc) still takes the xferOptimization fast path for INSERT INTO dest SELECT * FROM src. sqlite3AuthCheck is SQLITE_INSERT on dest only. The copy never calls sqlite3Select or per-column sqlite3AuthRead on src. SELECT * FROM src is denied. The INSERT SELECT copies the witness. The authorizer log is INSERT:dest.
Authorizer is off unless the embedder installs one. Not RCE. DRH treated Fossil d1cdb817 as a 3.54 feature, not a 3.53 bugfix. 3.54.0 is still draft.
| ID | no CVE yet |
| Class | Privilege leftover (READ-denied table copy) |
| Reach | Local (embedder sqlite3_set_authorizer) |
| CWE | CWE-863 |
| CVSS | High: 7.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Product | SQLite (Hwaci) |
| Affected | 3.53.4 (b09c88c14082339b66c7b7158d609a771e64ca69) |
| Auth | local SQL against an installed authorizer that DENY READ/SELECT on src and allows INSERT on dest |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18850 only |
Prepare INSERT INTO dest SELECT * FROM src when dest is schema-compatible and INSERT is allowed. Raw B-tree records leave a READ-denied source table and land in dest. Bare SELECT * FROM src is SQLITE_AUTH. The xfer path does not compile the SELECT, so source SQLITE_SELECT, table-level SQLITE_READ, and per-column sqlite3AuthRead never fire.
Needs an embedder that installed sqlite3_set_authorizer as the untrusted-SQL / column ACL gate. Default library has that callback NULL. Not RCE.
Same 3.53.4 Crit/High hunt as the other leftovers on this GA. Authorizer is documented at sqlite3_set_authorizer. INSERT auth is dest-table only (insert.c:969). xfer is taken before sqlite3Select() (insert.c:1020-1038). xferOptimization copies records. Grep of insert.c on this pin: one sqlite3AuthCheck, no sqlite3AuthRead. SQLITE_OMIT_XFER_OPT is not a default build flag.
Forum 2026-05-21T03:31:22Z. Trunk d1cdb817cafd03a4 is 3.54-only. DRH: new feature, not going onto branch-3.53.
cd lab
./run.sh
Builds amalgamation 3.53.4 plus lab/xfer_auth.c. Compose sqlite-xfer-auth. Bind 127.0.0.1:18850. Oracle is JSON from the in-process authorizer: SELECT * FROM src denied; INSERT INTO dest SELECT * FROM src ok; dest has SQLITE-XFER-AUTH-WITNESS; insert actions are INSERT:dest only.
SUCCESS sqlite-xfer-auth how=xfer-opt-skip-src-read select-src=denied insert-select=ok dest-has-witness=yes SQLITE-XFER-AUTH-WITNESS
Authorize the source the way 3.54 d1cdb817 does: if an authorizer is registered, xferOptimization must sqlite3AuthCheck SELECT/READ on src (or refuse the fast path and fall through to sqlite3Select). Until then, embedders that DENY READ on a table still have to DENY INSERT into any compatible dest, or compile with -DSQLITE_OMIT_XFER_OPT.
b09c88c14082339b66c7b7158d609a771e64ca69)src/insert.c sqlite3AuthCheck INSERT dest, xferOptimization before sqlite3Select