Executive brief
TryGhost's sqlite3 is a popular Node.js binding for SQLite databases, widely used in web applications for data persistence. A flaw in how the library handles query binding parameters allows attackers to inject arbitrary JavaScript code or trigger denial-of-service conditions by passing specially crafted objects as parameters, potentially leading to complete system compromise.
Technical details
The vulnerability exists in the .ToString() method implementation used to coerce binding parameters in sqlite3 versions 5.0.0 through 5.1.4. An attacker can supply a crafted JavaScript object as a query binding parameter; due to improper object-to-string coercion, this allows arbitrary JavaScript execution or denial-of-service attacks. The vulnerability requires network access but no authentication or user interaction. The attack surface is broad because applications may accept user-controlled data that flows into database query parameters. The issue was patched in version 5.1.5 with improved parameter sanitization.
Affected products
- TryGhost node-sqlite3 5.0.0 to 5.1.4
Timeline
- 2023-03-13: disclosed
- 2023-03-13: patched: Fixed in version 5.1.5
- 2022: other: CVE-2022-43441 assigned