Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 3 October 2024.

Which products and versions are affected?

@saltcorn/server (npm) SEMVER:introduced=0,fixed=1.0.0-beta.14.

Is there a fix for This vulnerability?

Yes. @saltcorn/server (npm): upgrade to 1.0.0-beta.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run @saltcorn/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Saltcorn Server remote code execution via prototype pollution

Severity: low · CVSS 3.1 · Published 2024-10-03

Saltcorn is a low-code web application platform used to build custom web applications. An authenticated administrator can exploit a prototype pollution vulnerability in the localizer endpoint to inject arbitrary code that is executed on the server, or to craft malicious SQL queries against the database. This allows an attacker with admin rights to achieve complete system compromise, including arbitrary file execution and unauthorized data access.

Technologies: @saltcorn/server (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 3 October 2024.
Which products and versions are affected?: @saltcorn/server (npm) SEMVER:introduced=0,fixed=1.0.0-beta.14.
Is there a fix for This vulnerability?: Yes. @saltcorn/server (npm): upgrade to 1.0.0-beta.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run @saltcorn/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@saltcorn/server (npm): upgrade to 1.0.0-beta.14 or later
```
npm install @saltcorn/server@1.0.0-beta.14
```

Technical details

The vulnerability is a prototype pollution flaw in the `/site-structure/localizer/save-string/:lang/:defstring` endpoint (packages/server/routes/infoarch.js). The `lang` and `defstring` parameters are directly used as object keys without sanitization, allowing an attacker to inject `__proto__` and modify Object.prototype properties. By polluting the `tempRootFolder` property, an attacker can inject shell metacharacters that are later executed in a child_process call during plugin installation, achieving RCE. Alternatively, by polluting the `schema` property, an attacker can inject SQL syntax into PostgreSQL queries, enabling SQL injection. The vulnerability requires authentication as an administrator and a POST request with valid CSRF tokens; it affects @saltcorn/server versions up to 1.0.0-beta.13 and is patched in 1.0.0-beta.14.

Affected products

Saltcorn @saltcorn/server <=1.0.0-beta.13

Timeline

2024-10-03: disclosed
2024-10-03: patched: Patched in version 1.0.0-beta.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.