Executive brief
Knex.js is a popular SQL query builder used by thousands of Node.js applications to safely construct database queries. Due to improper input validation, attackers can pass JavaScript objects as WHERE clause parameters to bypass query filters and extract unintended data from MySQL databases. This vulnerability allows attackers to ignore security restrictions intended to limit query results, potentially exposing sensitive information.
Technical details
Knex.js has a limited SQL injection vulnerability in the WHERE clause handler (CWE-89) affecting versions through 2.3.0. When an attacker passes a JavaScript object or array as a WHERE clause value (e.g., `.where({stringfield: {hello: 1}})`), the code does not validate the input type and instead interpolates the object keys directly into the SQL query. This behavior is specific to the MySQL driver; PostgreSQL and other backends properly reject such values. An attacker with the ability to control WHERE clause parameters (typically through HTTP request parameters) can craft payloads that rewrite WHERE conditions to ignore security filters, potentially reading arbitrary rows from the table. The fix, released in version 2.4.0, adds input type assertions to reject objects and arrays in basic WHERE clause values.
Affected products
- Knex knex through 2.3.0
Timeline
- 2016-02-25: disclosed: Vulnerability first reported on GitHub issue #1227
- 2023-01-05: patched: Fix merged in PR #5417
- 2023-01-06: patched: Version 2.4.0 released with fix
- 2022-12-19: advisory: GHSA-4jv9-3563-23j3 published