Skip to content

[Aikido] Fix security issue in typeorm via minor version upgrade from 0.2.25 to 0.3.29 - #42

Open
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-93674242-bgfs
Open

[Aikido] Fix security issue in typeorm via minor version upgrade from 0.2.25 to 0.3.29#42
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-93674242-bgfs

Conversation

@aikido-autofix

Copy link
Copy Markdown

Upgrade TypeORM to fix critical SQL injection in findOne and blind SQL injection in update/soft-delete queries affecting data exfiltration and DoS attacks.

⚠️ Breaking changes in this upgrade

All breaking changes by upgrading typeorm from version 0.2.25 to 0.3.29 (CHANGELOG)

Version Description
0.3.0
Minimal Node.js version requirement is now 14+
0.3.0
Support for ormconfig has been dropped
0.3.0
Support for previously deprecated migrations:* commands has been removed, use migration:* commands instead
0.3.0
CLI commands have been re-worked and no longer support ormconfig
0.3.0
aurora-data-api driver is now called aurora-mysql
0.3.0
aurora-data-api-pg driver is now called aurora-postgres
0.3.0
EntityManager.connection is now EntityManager.dataSource
0.3.0
Repository now has a constructor (breaks classes extending Repository with custom constructor)
0.3.0
@TransactionRepository, @transactionManager, @transaction decorators have been completely removed
0.3.0
findOne() signature without parameters has been dropped
0.3.0
findOne(id) signature has been dropped, use findOneBy instead
0.3.0
find*, count* methods now only accept FindOptions as parameter
0.3.0
findOne and QueryBuilder.getOne() now return null instead of undefined when no result is found
0.3.0
findOne now limits returning rows to 1 at database level
0.3.0
where in FindOptions is more sensitive to input criteria
0.3.0
null as value in where used in find* methods is not supported anymore, use IsNull() operator instead
0.3.0
order in FindOptions doesn't support ordering by relations anymore
0.3.0
where in FindOptions no longer supports ObjectLiteral and string types
0.3.0
MongoRepository and MongoEntityManager now use new types called MongoFindManyOptions and MongoFindOneOptions for their find* methods
0.3.0
Primary relation support has been removed, explicit primary column definition is now required
✅ 2 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2022-33171
🚨 CRITICAL
[typeorm] A SQL injection vulnerability exists in the findOne function when user-controlled JSON input is passed as a FindOneOptions object instead of an id string. This allows attackers to execute arbitrary SQL queries and potentially achieve remote code execution or data exfiltration.
GHSA-9ggv-8w38-r7pm
MEDIUM
[typeorm] Blind SQL injection vulnerability in UpdateQueryBuilder and SoftDeleteQueryBuilder where the order parameter is not validated against allowed values (ASC/DESC) and is concatenated directly into SQL. Attackers can inject arbitrary SQL to exfiltrate data, manipulate row targeting, or cause denial of service.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants