GHSA-4qhx-g9wp-g9m6

Source

https://github.com/advisories/GHSA-4qhx-g9wp-g9m6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-4qhx-g9wp-g9m6/GHSA-4qhx-g9wp-g9m6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4qhx-g9wp-g9m6

Published

2019-06-14T16:09:01Z

Modified

2021-09-16T21:00:23Z

Summary

Failure to sanitize quotes which can lead to sql injection in squel

Details

All versions of squel are vulnerable to sql injection.

The squel package does not properly escape user provided input when provided using the setFields method. This could lead to sql injection if the query was then executed.

Proof of concept demonstrating the injection of a single quote into a generated sql statement from user provided input.

> console.log(squel.insert().into('buh').setFields({foo: "bar'baz"}).toString());
INSERT INTO buh (foo) VALUES ('bar'baz')

Recommendation

There is no fix at this time and the issue has been reported publicly. Consider using another query builder that provides strong guarantees for input sanitization to prevent sql injection attacks.

Database specific

{
    "cwe_ids":  [
        "CWE-74",
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-06-14T16:08:38Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

npm / squel

Package

Name: squel; View open source insights on deps.dev
Purl: pkg:npm/squel

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

5.13.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-4qhx-g9wp-g9m6/GHSA-4qhx-g9wp-g9m6.json"