Severity
2.3
Low severity
Details
- CVSS score
- 2.3
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
Impact
SQL Injection can occur when:
- The non-default simple protocol is used.
- A dollar quoted string literal is used in the SQL query.
- That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.
- The value of that placeholder is controllable by the attacker.
e.g.
attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)
This is unlikely to occur outside of a contrived scenario.
Patches
The problem is resolved in v5.9.2.
Workarounds
Do not use the simple protocol to execute queries matching all the above conditions.
Details
- Affected product:
- GoogleCloudPlatform/cloud-sql-proxy/cloudsql-proxy , Grafana , Loki , TritonDataCenter/triton-go , cortexproject/cortex , gobuffalo/pop , golang-migrate/migrate , google/go-cloud , hashicorp/consul , hashicorp/go-discover , influxdata/telegraf , jackc/pgconn , jackc/pgmock , jackc/pgtype , jackc/pgx , openfga/openfga , ory/fosite , ory/x , pressly/goose
- Affected packages:
- github.com/jackc/pgx @ 5.5.5 (+37 more)