GHSA-v49j-62m6-pgrr: SQL Injection
Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload.
You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins.
You are not affected if you use MongoDB (@payloadcms/mongodb).
Patches Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.
Workarounds Upgrading to a patched version is recommended. Until you can upgrade, restrict untrusted users from supplying dynamic query filters or join parameters and limit read access to affected collections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Compensating control
Restrict untrusted users from supplying dynamic query filters or join parameters, and limit read access to affected collections until Payload is upgraded.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using an affected Payload version are exposed when untrusted users can query readable collections through dynamic filters or join parameters. Deployments using the MongoDB adapter (@payloadcms/mongodb) are not affected.
What access does an attacker need to exploit it?
An attacker must be able to submit requests that supply dynamic query filters or join parameters against collections they can read. No authenticated access is necessarily required if untrusted users can make those queries anonymously.
What can be done before upgrading?
Restrict untrusted users from supplying dynamic query filters or join parameters, and limit read access to affected collections. Upgrade Payload packages to version 3.88.0 or later, or 4.0.0-canary.27 or later, as soon as possible.