PT-2022-23048 · Postgres+1 · Postgres+1

Achrinz

·

Published

2022-08-11

·

Updated

2022-08-16

·

CVE-2022-35942

CVSS v3.1

9.3

Critical

VectorAV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions LoopBack versions prior to 5.5.1
Description Improper input validation on the contains LoopBack filter may allow for arbitrary SQL injection. When the extended filter property contains is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database. This affects users who connect to the database via the DataSource with allowExtendedProperties: true setting, use the connector's CRUD methods directly, or use the connector's other methods to interpret the LoopBack filter.
Recommendations For versions prior to 5.5.1, upgrade to version 5.5.1 to resolve the issue. If unable to upgrade, remove allowExtendedProperties: true DataSource setting and add allowExtendedProperties: false DataSource setting. When passing directly to the connector functions, manually sanitize the user input for the contains LoopBack filter beforehand.

Exploit

Fix

SQL injection

RCE

Weakness Enumeration

CWE-89CWE-20

Related Identifiers

CVE-2022-35942
GHSA-J259-6C58-9M58

Affected Products

Loopback
Postgres