Executive brief
Shelf, an open-source platform for tracking physical assets, contains a security flaw that allows any logged-in user to access sensitive database information. By sending specially crafted web requests, an attacker can bypass security boundaries to read data belonging to other organizations or users. This could lead to the exposure of private asset records, user emails, and other internal database contents.
Technical details
A SQL injection vulnerability exists in the `parseSortingOptions()` function within `apps/webapp/app/modules/asset/query.server.ts`. The application fails to validate the 'direction' component of the `sortBy` query parameter, which is subsequently interpolated directly into a raw SQL `ORDER BY` clause and executed via `prisma.$queryRaw()`. An authenticated attacker can exploit this by providing malicious SQL fragments in the `sortBy` parameter to perform boolean-based or error-based inference attacks. This allows for unauthorized data extraction from any table in the database, including cross-tenant data. The issue is resolved in version 1.20.1 by implementing an allowlist for sort directions and strict regex validation for SQL identifiers.
Affected products
- Shelf-nu Shelf 1.12 to 1.20.0
Timeline
- 2024-11-12: other: Vulnerability introduced in version 1.12
- 2026-04-27: patched: Fix committed and advisory published by vendor
- 2026-05-12: disclosed: CVE published to NVD