Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

Not that I’m disproving it but do you have a source? Companies say all kinds of things for hype and to attract investors, but it doesn’t necessarily make it true.

Re: Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

#5

Post by thenaturalist » Wed, Dec 17, 2025, 9:49 PM UTC

Wow, chapeau to the author.

What an elegant, interesting read.

What I don't quite understand: Why is the Clickhouse bug not given more scrutiny?

Like that escape bug was what made the RCE possible and certainly a core DB company like ClickHouse should be held accountable for such an oversight?

Re: Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

#6

Post by matmuls » Wed, Dec 17, 2025, 10:10 PM UTC

thenaturalist wrote: post #5

Wow, chapeau to the author. What an elegant, interesting read. What I don't quite understand: Why is the Clickhouse bug not given more scrutiny? Like that escape bug was what made the RCE possible and certainly a core DB company like ClickHouse should be held accountable for such an oversight?

ssrf was the entry point, and clickhouse is supposed to be an internal only service, but one could reach it only with that ssrf, so hence less of "scrutiny". The 0day by itself wouldnt be useful, unless an attacker can reach clickhouse, which they usually can't.

Re: Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

#7

Post by matmuls » Wed, Dec 17, 2025, 10:14 PM UTC

Nextgrid wrote: post #4

taw_1265 wrote: post #3

PostHog does a lot of vibe coding, I wonder how many other issues they have.

Not that I’m disproving it but do you have a source? Companies say all kinds of things for hype and to attract investors, but it doesn’t necessarily make it true.

looking at their commits, there are about 300+ commits tagged with " Generated with https://claude.com/claude-code" attribution.

Re: Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

#8

Post by lkt » Wed, Dec 17, 2025, 10:18 PM UTC

Out of interest, how much does ZDI pay for a bug like this?

Re: Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

#9

Post by dewey » Wed, Dec 17, 2025, 10:19 PM UTC

matmuls wrote: post #7

Nextgrid wrote: post #4

Earlier quoted context omitted.

Not that I’m disproving it but do you have a source? Companies say all kinds of things for hype and to attract investors, but it doesn’t necessarily make it true.

looking at their commits, there are about 300+ commits tagged with " Generated with https://claude.com/claude-code " attribution.

Just because AI tools are involved doesn't mean it's "Vibe coding".

Re: Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

#10

Post by thenaturalist » Wed, Dec 17, 2025, 10:39 PM UTC

matmuls wrote: post #6

thenaturalist wrote: post #5

Wow, chapeau to the author. What an elegant, interesting read. What I don't quite understand: Why is the Clickhouse bug not given more scrutiny? Like that escape bug was what made the RCE possible and certainly a core DB company like ClickHouse should be held accountable for such an oversight?

ssrf was the entry point, and clickhouse is supposed to be an internal only service, but one could reach it only with that ssrf, so hence less of "scrutiny". The 0day by itself wouldnt be useful, unless an attacker can reach clickhouse, which they usually can't.

But if they do, prohibiting SQL injection, a critical last mile vulnerability, seems trivial?