Executive brief
sqlite3 is a popular Node.js library for querying SQLite databases. When an application passes certain malformed objects as query parameters, sqlite3 crashes with an unrecoverable error, causing the entire application to terminate. An attacker with control over input data supplied to queries can trigger this crash and disrupt service availability.
Technical details
The vulnerability is a denial-of-service flaw in sqlite3's parameter binding logic (CWE-248: Uncaught Exception). When specific invalid object types are passed in the parameter array during query execution, the library throws a fatal error that cannot be caught by application error handlers, forcing immediate termination. The flaw affects versions 5.0.0 through 5.0.2 and requires network access (remote exploitation via data input) with no authentication or user interaction. An attacker can exploit this by supplying crafted objects as bind parameters in any application using the vulnerable library. The fix was released in version 5.0.3.
Affected products
- TryGhost sqlite3 5.0.0-5.0.2
Timeline
- 2022-04-28: disclosed
- 2022-04-28: patched: Fixed in v5.0.3
- 2022-05-01: advisory