Packages / pg / Security

CriticalVulnerabilityGHSA-wc9v-mj63-m9g5CVE-2017-16082Published 24 Jul 2018

Remote Code Execution in pg

Affected releases · pg

  • 7.x7.0.0 – 7.1.1Fixed in 7.1.2
  • 6.x6.0.0 – 6.4.1Fixed in 6.4.2
  • 5.x5.0.0 – 5.2.0Fixed in 5.2.1
  • 4.x4.0.0 – 4.5.6Fixed in 4.5.7
  • 3.x3.0.0 – 3.6.3Fixed in 3.6.4
  • 2.x2.0.0 – 2.11.1Fixed in 2.11.2
  • 1.x and older0.0.1 – 1.3.0No fix, no longer updated

On 7.x, the newest line:

npm install pg@7.1.2
8.x

  1. Not affected

    8.0.0 – 8.23.1

    56 releases, latest

7.x

  1. Affected

    7.0.0 – 7.0.1

    2 releases

  2. Fixed

    7.0.2 – 7.0.3

    2 releases

  3. Affected

    7.1.0 – 7.1.1

    2 releases

  4. Fixed

    7.1.2 – 7.18.2

    32 releases

6.x

  1. Affected

    6.0.0 – 6.0.4

    5 releases

  2. Fixed

    6.0.5

    1 release

  3. Affected

    6.1.0 – 6.1.5

    6 releases

  4. Fixed

    6.1.6

    1 release

  5. Affected

    6.2.2 – 6.2.4

    3 releases

  6. Fixed

    6.2.5

    1 release

  7. Affected

    6.3.0 – 6.3.1

    2 releases

  8. Fixed

    6.3.3

    1 release

  9. Affected

    6.4.0 – 6.4.1

    2 releases

  10. Fixed

    6.4.2

    1 release

5.x

  1. Affected

    5.0.0 – 5.2.0

    3 releases

  2. Fixed

    5.2.1

    1 release

4.x

  1. Affected

    4.0.0 – 4.5.6

    19 releases

  2. Fixed

    4.5.7

    1 release

3.x

  1. Affected

    3.0.0 – 3.6.3

    18 releases

  2. Fixed

    3.6.4

    1 release

2.x

  1. Affected

    2.0.0 – 2.11.1

    22 releases

  2. Fixed

    2.11.2

    1 release

1.x

  1. Affected

    1.0.0 – 1.3.0

    11 releases

0.x

  1. Affected

    0.0.1 – 0.15.1

    78 releases

272 stable releases of pg, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for pg. It is read in your browser and sent nowhere.

What happens

Affected versions of pg contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name.

There are two specific scenarios in which it is likely for an application to be vulnerable:

  1. The application executes unsafe, user-supplied sql which contains malicious column names.

  2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name.

Proof of Concept

const { Client } = require('pg')
const client = new Client()
client.connect()

const sql = `SELECT 1 AS "\\'/*", 2 AS "\\'*/\n + console.log(process.env)] = null;\n//"`

client.query(sql, (err, res) => {
  client.end()
})

Recommendation

  • Version 2.x.x: Update to version 2.11.2 or later.

  • Version 3.x.x: Update to version 3.6.4 or later.

  • Version 4.x.x: Update to version 4.5.7 or later.

  • Version 5.x.x: Update to version 5.2.1 or later.

  • Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )

  • Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )