Executive brief
IBM LoopBack Connector for PostgreSQL is a library that enables applications to connect to and query PostgreSQL databases. A flaw in how the library processes the "contains" filter allows attackers to inject arbitrary SQL commands into database queries, potentially allowing them to read, modify, or delete sensitive data stored in the database.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) caused by improper input validation (CWE-20) in the handling of the "contains" LoopBack filter property. The connector fails to sanitize user-supplied input when constructing SQL queries, allowing an attacker to inject malicious SQL. The attack can occur when applications connect to the database with the allowExtendedProperties: true setting, pass user input directly to the connector's CRUD methods, or use the connector's filter interpretation methods. An unauthenticated, local attacker with no special privileges can exploit this to gain high-impact access to data confidentiality, integrity, and potentially availability. Patch version 5.5.1 resolves the issue; workarounds include disabling allowExtendedProperties or manually sanitizing input beforehand.
Affected products
- IBM LoopBack Connector PostgreSQL < 5.5.1
Timeline
- 2022-08-11: disclosed
- 2022-08-11: patched: loopback-connector-postgresql 5.5.1 released