Executive brief
Sails-MySQL is a database adapter for the Sails.js web framework that handles MySQL queries. Versions before 0.10.8 fail to sanitize the sort query parameter, allowing attackers to inject arbitrary SQL commands through HTTP requests. A successful exploit could expose sensitive data from the database without requiring authentication or user interaction.
Technical details
A SQL injection vulnerability (CWE-89) exists in sails-mysql versions prior to 0.10.8 in the handling of the sort query parameter. The vulnerable component fails to properly sanitize user input before constructing SQL queries, allowing attackers to inject SQL syntax. An attacker can craft a malicious sort parameter (e.g., `sort=name ASC`) in HTTP GET requests to the default REST routes exposed by Sails.js. The vulnerability is network-reachable and requires no authentication or user interaction. Successful exploitation allows an attacker to read sensitive data from the MySQL database. The fix is available in version 0.10.8 and later.
Affected products
- Sails sails-mysql before 0.10.8
Timeline
- 2014-09-11: disclosed: Original issue reported on GitHub
- 2020-09-03: advisory: GHSA advisory published
- 2020-09-03: patched: Fix available in version 0.10.8