a12nserver SQL injection via Knex dependency

Severity: low · CVSS 3.1 · Published 2023-01-13

a12nserver is an OAuth2 authorization server used to manage user access tokens and authentication. When using MySQL databases, a SQL injection vulnerability in the Knex query builder (a dependency) could allow an attacker with administrative privileges to extract OAuth2 access tokens for arbitrary users, potentially granting unauthorized access to integrated applications and sensitive user data.

Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 3.1, published 13 January 2023.
Which products and versions are affected?
Curveball A12nserver 0.20.0 to <0.23.0; @curveball/a12n-server (npm) SEMVER:introduced=0.20.0,fixed=0.23.0.
Is there a fix for This vulnerability?
Yes. @curveball/a12n-server (npm): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Curveball A12nserver or @curveball/a12n-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @curveball/a12n-server (npm): upgrade to 0.23.0 or later
    npm install @curveball/a12n-server@0.23.0

Technical details

This vulnerability is a SQL injection (CWE-89) in the Knex query builder library that affects a12nserver when used with MySQL databases. The root cause stems from improper neutralization of special SQL characters in user-controllable inputs, allowing attackers to inject arbitrary SQL commands. An attacker requires high-level privileges (administrative access) to exploit this vulnerability, with no user interaction required and network-based attack capability. A successful exploit enables attackers to read sensitive data including OAuth2 access tokens for unauthorized users, potentially granting access to resources belonging to other user accounts. The vulnerability was patched by updating Knex to version 2.4.0 in a12nserver 0.23.0.

Affected products

  • Curveball a12nserver 0.20.0 to <0.23.0
  • Knex Knex <2.4.0

Timeline

  • 2023-01-13: disclosed
  • 2023-01-13: patched: a12nserver 0.23.0 released with Knex 2.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.