GHSA-wmw4-mw6x-6vfm: SQL Injection
Summary
ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. article.${key} ). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys.
Impact
An unauthenticated remote attacker can perform blind SQL injection against the application database, potentially exfiltrating sensitive data (users, settings, API keys, article content, etc.).
Affected endpoints (unauthenticated GET)
- GET /api/article - GET /api/comment - GET /api/file - GET /api/page - GET /api/Knowledge
Affected code
Vulnerable pattern in findAll() methods, including but not limited to:
- server/src/modules/article/article.service.ts - server/src/modules/comment/comment.service.ts - server/src/modules/file/file.service.ts - server/src/modules/page/page.service.ts - server/src/modules/knowledge/knowledge.service.ts
Remediation
- Whitelist allowed filter column names before interpolating into SQL. - Upgrade to @fecommunity/reactpress >= 3.7.0.
Credit
Reported by lsr365400.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@fecommunity/reactpressto a version that resolves this vulnerability.Fixed in 3.7.0 - Upgrade
Upgrade
@fecommunity/reactpressto a version that resolves this vulnerability.Fixed in 3.7.0 - Compensating control
Whitelist allowed filter column names before interpolating them into SQL in the ReactPress API list endpoints.
Event History
Frequently Asked Questions
Who is exposed to this issue?
ReactPress deployments that expose the listed unauthenticated GET API endpoints are exposed. The affected endpoints include article, comment, file, page, and Knowledge listing APIs.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. Exploitation requires sending crafted HTTP query-string parameter names to an affected list endpoint.
What should be done if an immediate upgrade is not possible?
Prevent untrusted requests from reaching the affected endpoints where possible, and modify the affected findAll() query construction to whitelist permitted filter column names before using them in SQL conditions. Parameterizing filter values alone does not address injection through parameter names.
How can teams identify vulnerable code in a deployment?
Review findAll() methods for HTTP query parameter keys interpolated as TypeORM QueryBuilder column identifiers, such as an article.${key} expression. The advisory identifies the article, comment, file, page, and knowledge service modules as affected locations.