CVE-2022-46908

What it actually does

The --safe flag in SQLite CLI fails to enforce the azProhibitedFunctions list, permitting user-defined functions such as WRITEFILE to execute and perform file-system operations from untrusted scripts.

Why it matters to the business

Organizations relying on SQLite's safe-mode execution for untrusted scripts face unauthorized file creation or modification, increasing risk of data tampering or exfiltration in environments that process external database scripts.

How an attack unfolds

An attacker supplies a malicious SQLite script containing calls to WRITEFILE or similar UDFs; when the script is executed via the CLI under the --safe option, the bypassed protection allows the function to write attacker-controlled content to arbitrary paths on the host.

How to fix it

Upgrade sqlite/sqlite (GIT) to commit 1fdaa9d1a79b05503ee5243e360b9b5dea0ff25c or later; avoid executing untrusted scripts with the CLI until patched; consider sandboxing or disabling UDF registration for untrusted input.

How to confirm the fix worked

Confirm the installed SQLite binary reports a version containing commit 1fdaa9d1a79b05503ee5243e360b9b5dea0ff25c; test that --safe now blocks WRITEFILE and other prohibited functions when running sample untrusted scripts.

Typical attack path

1. Locate applications or automation that invoke the SQLite CLI with the --safe flag on externally supplied scripts.
2. Craft a script that invokes prohibited UDFs such as WRITEFILE to target desired file paths.
3. Deliver the script to the vulnerable SQLite instance and trigger execution.
4. Verify successful file writes to confirm impact and proceed to data manipulation or persistence.

How to detect it

Review process execution logs and command-line history for sqlite3 invocations that include --safe together with scripts containing WRITEFILE or other UDF calls; inspect file-system audit logs for unexpected writes originating from the SQLite process.

What your security team should do

• Apply the listed commit or newer release across all SQLite deployments within 30 days.
• Audit code and scripts that invoke sqlite3 with --safe and replace with safer execution patterns.
• Add SQLite version checks to vulnerability scanning and CI pipelines.
• Monitor for any new public exploits given the existing proof-of-concept availability.