GHSA-9g87-32v6-3c2r: Infoleak
Impact Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.
You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.
Patches Payload now applies field-level access checks to sort fields before executing queries.
Users should upgrade to >= 3.88.0 or >= 4.0.0-canary.27.
Workarounds Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.88.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.27 - Compensating control
Prevent untrusted users from controlling sort parameters, or restrict their access to affected collections.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are affected when untrusted users can query a collection, control sorting, and request sorting by fields they are not permitted to read. Systems that do not allow untrusted control of sort parameters are not described as affected.
What does an attacker need to do to exploit it?
The attacker needs access to query a collection and the ability to control its sort fields. They must be able to sort on protected fields; under those conditions, sorting can reveal limited information about those fields.
What can be done if upgrading is not immediately possible?
Prevent untrusted users from controlling sort parameters, or restrict their access to affected collections. Upgrading remains the recommended remediation.
Which versions contain the fix?
Upgrade Payload to version 3.88.0 or later, or to 4.0.0-canary.27 or later. The fix applies field-level access checks to sort fields before queries execute.