PT-2020-17844 · Nozbe · @Nozbe/Watermelondb
Radexpublished
·
Published
2020-06-03
·
Updated
2020-06-11
·
CVE-2020-4035
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
@nozbe/watermelondb versions prior to 0.15.1
@nozbe/watermelondb versions prior to 0.16.2
Description
A maliciously crafted record ID can exploit a SQL Injection vulnerability in the iOS adapter implementation, causing the app to delete all or selected records from the database. This may happen in apps that don't validate IDs and use Watermelon Sync or the low-level
database.adapter.destroyDeletedRecords method. The integrity risk is low due to the fact that maliciously deleted records won't synchronize, so logout-login will restore all data. No way to breach confidentiality with this vulnerability is known. Full exploitation of SQL Injection is mitigated because it's not possible to nest an insert/update query inside a delete query in SQLite.Recommendations
For versions prior to 0.15.1, update to version 0.15.1 or later.
For versions prior to 0.16.2, update to version 0.16.2 or later.
As a temporary workaround, ensure that your backend service sanitizes record IDs sent in the "pull sync" endpoint, such that only IDs matching
/^[a-zA-Z0-9 -.]+$/ are returned.
If you use destroyDeletedRecords directly, validate all IDs passed the same way.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Nozbe/Watermelondb