CVE-2020-35666: SQL Injection
Published Dec 23, 2020
·Updated
Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedosbase.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id[$ne]=1 value.
Affected Software
1 affected component
Steedos Steedos<=1.21.24
Event History
Dec 23, 2020
CVE Published
via MITRE·07:49 PM
Data Sourced
via MITRE·07:49 PM
Description
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges and can exploit it remotely without user interaction.
2
Which endpoint and input are implicated?
The affected implementation is /api/collection/findone in server/packages/steedos_base.js. The issue stems from inadequate validation of req.body, allowing MongoDB operator-style input such as X-User-Id[$ne]=1.
3
What is the potential impact of successful exploitation?
The CVSS score assigns high impact to confidentiality, integrity, and availability, indicating that successful exploitation could affect all three.