CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-58450

pREST-o Change-o: Turning REST APIs into Remote Shells via CVE-2025-58450

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 2, 2026·6 min read·59 visits

Executive Summary (TL;DR)

pREST, the tool that magically turns PostgreSQL databases into REST APIs, had a magical flaw: it trusted user input to build SQL structure. By manipulating parameters like `_join` and `_returning`, attackers could bypass validation and execute arbitrary SQL, leading to total database compromise. Fixed in version 2.0.0-rc3.

A systemic SQL injection vulnerability in pREST allows unauthenticated remote attackers to execute arbitrary SQL commands via manipulated API parameters. The flaw stems from widespread string concatenation in critical query builders like JOIN and RETURNING clauses.

Official Patches

pRESTOfficial patch commit

Fix Analysis (1)

Technical Appendix

CVSS Score
9.3/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

pREST API ServerPostgreSQL Databases exposed via pREST

Affected Versions Detail

Product
Affected Versions
Fixed Version
pREST
prestd
< 2.0.0-rc32.0.0-rc3
AttributeDetail
CWE IDCWE-89
Attack VectorNetwork
CVSS v4.09.3 (Critical)
EPSS Score0.0004 (Low Confidence)
ImpactCritical (Data Exfiltration, RCE via SQL)
Exploit StatusPoC Available / High Probability

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1059.001Command and Scripting Interpreter: SQL
Execution
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Vulnerability Timeline

Vulnerability identified and Patch Released
2025-01-02
CVE-2025-58450 Assigned
2025-01-02

References & Sources

  • [1]GHSA-p46v-f2x8-qp98 Advisory
  • [2]NVD Entry

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•16 minutes ago•CVE-2026-71303
7.7

CVE-2026-71303: Server-Side Request Forgery Bypass in Netflix Lemur Authority Updates

Netflix Lemur, an open-source TLS certificate management framework, is affected by a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability arises from an incomplete patch for a previous security flaw, CVE-2026-55166. While Lemur version 1.9.2 validated the ACME directory URL against an allowlist during authority creation, it failed to perform the same checks when updating existing authorities. An authenticated user possessing an authority role can exploit this omission to replace the directory URL with internal or cloud metadata endpoints. During subsequent certificate issuance, the Lemur backend executes unauthorized requests, potentially leaking sensitive metadata or credentials.

Amit Schendel
Amit Schendel
0 views•6 min read
•about 1 hour ago•CVE-2026-71307
7.7

CVE-2026-71307: Plaintext Credential Exposure in Netflix Lemur Destinations API

An authorization bypass and information disclosure vulnerability in Netflix Lemur before version 1.9.3 allows authenticated, low-privilege users to retrieve raw destination configurations, exposing plaintext credentials such as SFTP passwords and private key passphrases.

Amit Schendel
Amit Schendel
2 views•6 min read
•about 2 hours ago•CVE-2026-71308
8.1

CVE-2026-71308: Missing Authorization and Lifecycle Hijacking in Netflix Lemur

Netflix Lemur before 1.9.3 contains a missing authorization vulnerability (CWE-862, CWE-639) when handling certificate creation, upload, or modification. Authenticated non-read-only users can manipulate the replaces parameter to silence expiration notifications and hijack certificate rotation tasks for arbitrary targets, leading to unauthorized TLS certificate deployment and traffic interception.

Alon Barad
Alon Barad
4 views•7 min read
•about 3 hours ago•CVE-2026-71317
6.5

CVE-2026-71317: Missing Authorization in Netflix Lemur Allows Unauthorized Subordinate CA Creation

CVE-2026-71317 is a critical Broken Object-Level Authorization (BOLA) / Missing Authorization vulnerability in Netflix Lemur versions prior to 1.9.3. When the self-service authority creation option is enabled (ADMIN_ONLY_AUTHORITY_CREATION = False), Lemur allows authenticated non-read-only users to request the creation of a subordinate Certificate Authority (sub-CA) chained to any internal parent authority, even if the requesting user lacks administrative or usage permissions over that parent CA. This allows attackers to generate subordinate CAs signed by trusted root certificates, exposing private keys and compromising the organizational PKI trust chain.

Alon Barad
Alon Barad
4 views•7 min read
•about 4 hours ago•CVE-2026-71322
4.3

CVE-2026-71322: Missing Authorization Check in Netflix Lemur Certificate Export

Netflix Lemur, a TLS/SSL certificate management framework, contains a missing authorization check in its certificate export endpoint. Prior to version 1.9.3, the validation logic verifying whether a user had permission to export a certificate was incorrectly placed inside a block that executed only if the selected plugin required a private key. When an authenticated user attempted to export a certificate using a plugin that did not require the private key, the authorization check was bypassed, allowing unauthorized access to the public portions of the certificate and producing misleading audit logs.

Alon Barad
Alon Barad
3 views•6 min read
•about 5 hours ago•GHSA-JF24-8G2H-2WG7
7.2

GHSA-JF24-8G2H-2WG7: Remote Code Execution in LibreNMS AboutController via Binary Path Substitution

A critical security flaw in LibreNMS allows authenticated administrators to execute arbitrary commands by modifying the configured binary path for snmpget and accessing the About page. This occurs due to insufficient verification of the executable file's identity and integrity prior to executing it with shell_exec.

Amit Schendel
Amit Schendel
2 views•6 min read