GHSA-fxf7-vhh8-7vpq: SQL Injection
Impact The FunctionsBuilder::jsonValue($field, $jsonPath) methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter.
Patches 5.1.10, 5.2.15, 5.3.7
Workarounds Don't provide user controlled data to these functions/parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.1.10 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.2.15 - Upgrade
Upgrade
composer/cakephp/databaseto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.1.10 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.2.15 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 5.3.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.1.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.2.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.3.7 - Configuration
Ensure the value passed to the FunctionsBuilder::jsonValue($field, $jsonPath) method's $jsonPath parameter is not derived from user input; treat $jsonPath as non-user-controlled to prevent SQL injection.
FunctionsBuilder::jsonValue($field, $jsonPath) (Postgres driver) jsonPath parameter handling = Do not supply user-controlled data to $jsonPath
Event History
Frequently Asked Questions
What condition makes an application exploitable?
Exploitation requires user-controlled data to reach the $jsonPath parameter of FunctionsBuilder::jsonValue($field, $jsonPath) while using the Postgres driver. The issue is SQL injection through that parameter.
Which releases contain fixes?
The advisory lists patches in versions 5.1.10, 5.2.15, and 5.3.7.
What can be done if upgrading cannot happen immediately?
Do not pass user-controlled data to FunctionsBuilder::jsonValue() or its $jsonPath parameter. Ensure JSON paths supplied to this function are application-defined rather than derived from request input.