جزئیات آسیب‌پذیری

Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2.

• https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h x_refsource_CONFIRM
• https://github.com/nuxt/content/pull/3819 x_refsource_MISC
• https://github.com/nuxt/content/commit/847d523a48e76d861175b325abf0de40dc5864ed x_refsource_MISC
• https://github.com/nuxt/content/releases/tag/v3.15.2 x_refsource_MISC