Executive brief
crud-query-parser is a Node.js library used to parse and validate query parameters for database operations via TypeORM. A SQL injection vulnerability in the order/sort parameter allows unauthenticated attackers to execute arbitrary SQL queries if the TypeORM adapter is used with ordering enabled and no property filter is configured, potentially exposing sensitive database contents or modifying data.
Technical details
The vulnerability is a SQL injection (CWE-89) caused by improper neutralization of the order/sort parameter in the TypeORM adapter. The flaw affects versions 0.0.1, 0.0.2, and 0.0.3 and requires that ordering is enabled and no property allowlist filter is configured. An attacker can supply malicious SQL in the order parameter via a network request to execute arbitrary SQL commands. The vulnerability has been patched in version 0.1.0 and later, which introduces TypeORM field validation by default. Workarounds include using the filterProperties function to allowlist valid fields or disabling ordering entirely.
Affected products
- Guichaguri crud-query-parser 0.0.1, 0.0.2, 0.0.3
Timeline
- 2025-04-08: disclosed: Vulnerability published to GitHub Advisory
- 2025-04-09: patched: Fix released in version 0.1.0 with TypeORM field validation enabled by default