CVE-2022-33171: SQL Injection
DISPUTED The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using TypeORM versions before 0.3.0 may be exposed if they pass user-controlled parsed JSON directly to findOne where an ID string is expected. The reported issue depends on the application allowing a caller to supply a crafted FindOneOptions object instead.
Does an attacker need authentication or user interaction?
The supplied CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction. In practice, the vulnerable application path must accept attacker-controlled JSON and pass it to findOne without appropriate input validation.
Is this considered a confirmed TypeORM vulnerability?
The issue is marked disputed. The vendor position stated in the advisory is that applications are responsible for validating input before it reaches findOne.
What can be done if upgrading is not immediately possible?
Do not pass user-controlled parsed JSON objects directly to findOne. Validate that values intended as identifiers are strings and reject or transform unexpected object input before calling the function.