Vulnerability · Published Aug 12, 2022 · Assigned by GitHub_M
CVE-2022-35942loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter
Critical 9.3
In plain English
A critical-severity SQL injection in loopback-connector-postgresql from loopbackio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database. A patch was released in version 5.5.1. This affects users who does any of the following: - Connect to the database via the DataSource with `allowExtendedProperties: true` setting OR - Uses the connector's CRUD methods directly OR - Uses the connector's other methods to interpret the LoopBack filter. Users who are unable to upgrade should do the following if applicable: - Remove `allowExtendedProperties: true` DataSource setting - Add `allowExtendedProperties: false` DataSource setting - When passing directly to the connector functions, manually sanitize the user input for the `contains` LoopBack filter beforehand.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | loopback-connector-postgresql | 5.5.1 | GHSA-j259-6c58-9m58 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| loopbackio | loopback-connector-postgresql | < 5.5.1 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H