Executive brief
Squel is a popular JavaScript library used to safely build SQL queries in web and Node.js applications. The library fails to properly escape user input in its setFields method, allowing an attacker to break out of quoted strings and inject malicious SQL code. An exploit could enable unauthorized database access, data theft, or data manipulation depending on the application's database permissions.
Technical details
The vulnerability is a classic SQL injection flaw (CWE-89) in Squel's quote sanitization. The setFields method does not properly escape single quotes in user-provided field values, allowing an attacker to inject arbitrary SQL by providing input such as "bar'baz" which generates malformed SQL: INSERT INTO buh (foo) VALUES ('bar'baz'). The vulnerability affects all versions through 5.13.0. Attack precondition is that an application must use setFields with untrusted input and execute the generated query against a database. No patch is available as of the advisory publication date (2019-06-14); the project recommends switching to an alternative query builder with stronger input sanitization guarantees.
Affected products
- hiddentao squel 0 through 5.13.0
Timeline
- 2019-06-14: disclosed: Vulnerability published