Executive brief
connect-pg-simple is a Node.js library that manages user sessions in PostgreSQL databases. A SQL injection vulnerability exists if application developers pass unsanitized user input to the table name or schema name configuration options. An attacker could inject malicious SQL commands to read or modify database contents, though exploitation requires the application to pass untrusted input directly to these configuration parameters.
Technical details
A SQL injection vulnerability (CWE-89) exists in connect-pg-simple versions before 6.0.1 due to insufficient sanitization of the tableName and schemaName constructor options. The vulnerability is triggered when unsanitized user input is passed directly as these configuration parameters. An attacker with the ability to control these options can inject arbitrary SQL to read, modify, or delete data from the connected PostgreSQL database. Exploitation requires the application to expose these options to user-controlled input, which is unlikely in typical deployments. The vulnerability was fixed in version 6.0.1; no backport was provided to the 5.x branch due to low practical impact.
Affected products
- npm connect-pg-simple <6.0.1
Timeline
- 2019-08-26: disclosed
- 2019-08-26: patched: Version 6.0.1 released