Quick answers
- Is CVE-2022-33171 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-33171 being exploited in the wild.
- How severe is CVE-2022-33171?
- Low severity, with a CVSS score of 3.1, published 5 July 2022.
- Which products and versions are affected?
- typeorm (npm) SEMVER:introduced=0,fixed=0.3.0.
- Is there a fix for CVE-2022-33171?
- Yes. typeorm (npm): upgrade to 0.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-33171 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-33171?
- Check whether you run typeorm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- typeorm (npm): upgrade to 0.3.0 or later
npm install typeorm@0.3.0
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in TypeORM's findOne function. The function accepts either a string ID or a FindOneOptions object; when user-supplied parsed JSON is passed without validation, an attacker can provide a crafted FindOneOptions object instead of an expected ID string to inject arbitrary SQL. The attack requires network access and does not require authentication or user interaction. An attacker can achieve full database compromise including reading sensitive data and modifying or deleting records. The vulnerability was fixed in TypeORM 0.3.0 and all prior versions (0.2.45 and earlier) are affected. The vendor notes that application-level input validation is the responsibility of the user's application.
Affected products
- TypeORM typeorm before 0.3.0
Identifiers
- CVE-2022-33171
- GHSA-fx4w-v43j-vc45
Timeline
- 2022-07-05: disclosed: GHSA-fx4w-v43j-vc45 published
- 2022-03-17: patched: Fixed in version 0.3.0