Executive brief
Saltcorn is a low-code web application platform used to build custom web applications. An authenticated administrator can exploit a prototype pollution vulnerability in the localizer endpoint to inject arbitrary code that is executed on the server, or to craft malicious SQL queries against the database. This allows an attacker with admin rights to achieve complete system compromise, including arbitrary file execution and unauthorized data access.
Technical details
The vulnerability is a prototype pollution flaw in the `/site-structure/localizer/save-string/:lang/:defstring` endpoint (packages/server/routes/infoarch.js). The `lang` and `defstring` parameters are directly used as object keys without sanitization, allowing an attacker to inject `__proto__` and modify Object.prototype properties. By polluting the `tempRootFolder` property, an attacker can inject shell metacharacters that are later executed in a child_process call during plugin installation, achieving RCE. Alternatively, by polluting the `schema` property, an attacker can inject SQL syntax into PostgreSQL queries, enabling SQL injection. The vulnerability requires authentication as an administrator and a POST request with valid CSRF tokens; it affects @saltcorn/server versions up to 1.0.0-beta.13 and is patched in 1.0.0-beta.14.
Affected products
- Saltcorn @saltcorn/server <=1.0.0-beta.13
Timeline
- 2024-10-03: disclosed
- 2024-10-03: patched: Patched in version 1.0.0-beta.14