Executive brief
pg is a Node.js PostgreSQL database client library used by JavaScript applications to connect to and query PostgreSQL databases. A code injection vulnerability in how pg processes database column names allows attackers to execute arbitrary JavaScript code on the application server when the application either executes user-supplied SQL with malicious column names or connects to an untrusted database that returns crafted results. This can lead to complete system compromise and data theft.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the pg library's result parsing logic. When processing query results, pg dynamically constructs JavaScript code to map column names to result objects without properly sanitizing column names, allowing an attacker to inject arbitrary code through crafted column name syntax. An attacker can exploit this by either submitting malicious SQL with specially-crafted column names (if the application accepts user input for SQL) or by connecting to a compromised/attacker-controlled PostgreSQL database that returns results with malicious column names. No authentication or user interaction is required; the attack triggers on query result processing. Patches are available for all affected versions (2.11.2, 3.6.4, 4.5.7, 5.2.1, 6.0.5+, 7.0.2+, and 7.1.2+).
Affected products
- node-postgres pg < 2.11.2, 3.0.0-3.6.3, 4.0.0-4.5.6, 5.0.0-5.2.0, 6.0.0-6.4.1 (multiple branches), 7.0.0-7.1.1
Timeline
- 2018-07-24: disclosed
- 2017-08-12: patched: Patches released for all affected versions