Executive brief
TypeORM is a popular object-relational mapping (ORM) library used by JavaScript and TypeScript applications to interact with databases. A flaw in field name validation allowed attackers to inject arbitrary SQL code through query parameters, potentially enabling unauthorized data access, modification, or deletion. This vulnerability affects applications using TypeORM to process user-supplied data in database queries.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in TypeORM versions before 0.1.15, where field names in find options were not properly validated or sanitized. An attacker could craft malicious input containing SQL expressions in field name parameters, allowing arbitrary SQL statement execution. The vulnerability was discoverable through the Find API when user-controlled data was passed as object keys without sanitization. No authentication is required to exploit this if the application exposes query functionality to unauthenticated users. The fix (commit d46c8b0e6c0db56bb5976a4917e9f67a43715111) implemented proper validation of field names in find options. Patch is available in version 0.1.15 and later.
Affected products
- TypeORM typeorm before 0.1.15
Timeline
- 2019-06-06: disclosed
- 2018-03-07: patched: Fix committed; version 0.1.15 released with the patch