جزئیات آسیب‌پذیری

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

• https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw x_refsource_CONFIRM
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/144b8f4ef29539a9fb4b75d972b9dcdac4088b4e x_refsource_MISC
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6743b2f4a89b074268b44c650170767f35e1fb5d x_refsource_MISC
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/8eb450972ff0f3826d7d45c071a42240798bc826 x_refsource_MISC
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b9b04ec82a60b2caf2b0c038259ca9aff5d7014a x_refsource_MISC
• https://hackerone.com/reports/3889198 x_refsource_MISC
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5 x_refsource_MISC
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4 x_refsource_MISC
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7 x_refsource_MISC
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4 x_refsource_MISC
• https://jira.mariadb.org/browse/CONJS-369 x_refsource_MISC