Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Low severity, with a CVSS score of 3.1, published 6 June 2019.
- Which products and versions are affected?
- typeorm (npm) SEMVER:introduced=0,fixed=0.1.15.
- Is there a fix for This vulnerability?
- Yes. typeorm (npm): upgrade to 0.1.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run typeorm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- typeorm (npm): upgrade to 0.1.15 or later
npm install typeorm@0.1.15
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in TypeORM versions before 0.1.15, where field names in find options were not properly validated or sanitized. An attacker could craft malicious input containing SQL expressions in field name parameters, allowing arbitrary SQL statement execution. The vulnerability was discoverable through the Find API when user-controlled data was passed as object keys without sanitization. No authentication is required to exploit this if the application exposes query functionality to unauthenticated users. The fix (commit d46c8b0e6c0db56bb5976a4917e9f67a43715111) implemented proper validation of field names in find options. Patch is available in version 0.1.15 and later.
Affected products
- TypeORM typeorm before 0.1.15
Timeline
- 2019-06-06: disclosed
- 2018-03-07: patched: Fix committed; version 0.1.15 released with the patch