PT-2025-36515 · Prest · Prest
CVSS v4.0
10
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
pREST versions prior to 2.0.0-rc3
Description:
pREST (PostgreSQL REST) is an API that delivers an application on top of a Postgres database. Multiple SQL injection flaws exist due to insufficient input validation when constructing SQL queries. These vulnerabilities allow attackers to read sensitive files, steal credentials, and manipulate databases. Specifically, issues arise from string concatenation operations using unvalidated user input, improper handling of identifiers, and vulnerabilities in
tsquery predicates and script templates. The chkInvalidIdentifier function's validation logic is also flawed, enabling injection attacks. Exploitation can lead to unauthorized access and modification of data, and potentially access to files on the underlying file system or execution of arbitrary commands.Recommendations:
For versions prior to 2.0.0-rc3:
- Prevent all string concatenation operations that use unvalidated or unsanitized user input.
- Ensure that database identifiers (e.g., database and table names) only contain alphanumeric characters, dashes (
-), and underscores ( - Remove the double-quote from the list of allowed characters during validation.
- Update how query scripts are created and processed, recommending parametrized queries.
- As a temporary workaround, consider disabling the vulnerable API endpoints until a patch is available.
- Restrict access to the vulnerable modules to minimize the risk of exploitation.
Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Prest