Executive brief
TypeORM is a popular object-relational mapping (ORM) library used by Node.js developers to interact with databases. When an application accepts user-controlled input and passes it to TypeORM's findOne function without proper validation, an attacker can inject malicious SQL code, potentially leading to unauthorized data access, modification, or deletion of database records. This risk is particularly acute in APIs or web services that directly deserialize JSON input.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in TypeORM's findOne function. The function accepts either a string ID or a FindOneOptions object; when user-supplied parsed JSON is passed without validation, an attacker can provide a crafted FindOneOptions object instead of an expected ID string to inject arbitrary SQL. The attack requires network access and does not require authentication or user interaction. An attacker can achieve full database compromise including reading sensitive data and modifying or deleting records. The vulnerability was fixed in TypeORM 0.3.0 and all prior versions (0.2.45 and earlier) are affected. The vendor notes that application-level input validation is the responsibility of the user's application.
Affected products
- TypeORM typeorm before 0.3.0
Timeline
- 2022-07-05: disclosed: GHSA-fx4w-v43j-vc45 published
- 2022-03-17: patched: Fixed in version 0.3.0