SQL Injection Affecting knex package, versions <0.6.23 >=0.7.0 <0.7.6


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID npm:knex:20150413
  • published 20 Dec 2016
  • disclosed 12 Apr 2015
  • credit Jorge Godoy

Introduced: 12 Apr 2015

CVE NOT AVAILABLE CWE-89 Open this link in a new tab

How to fix?

Upgrade knex to versions 0.6.23, 0.7.6 or higher.

Overview

knex is a batteries-included SQL query & schema builder for Postgres, MySQL and SQLite3 and the Browser.

Column names are not properly escaped in the postgreSQL dialect. This may allow attackers to craft a query to the host DB and access private information. Writing the following code:

var query = knex.select('id","name').from('test')
console.log(query.toSQL())

Has the following result:

{ method: 'select',
  options: undefined,
  bindings: [],
  sql: 'select "id","name" from "test"' }

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
6.5 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    Low
  • Availability (A)
    Low