CVE-2020-4035: DoS via malicious record IDs in WatermelonDB
Summary
CVE-2020-4035: DoS via malicious record IDs in WatermelonDB. Affects @nozbe/watermelondb across 2 version ranges.
< 0.15.1
>= 0.16.0, < 0.16.2
Fixed in 0.15.1 or 0.16.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WatermelonDB is an open-source JavaScript library for managing an in-memory database in React Native applications. It provides a simple and efficient way to store and retrieve data locally. However, a vulnerability has been discovered in WatermelonDB that allows for a denial-of-service (DoS) attack using malicious record IDs.
Vulnerability Detail
The vulnerability arises from a SQL Injection vulnerability in the iOS adapter implementation of WatermelonDB. By crafting a malicious record ID, an attacker can exploit this vulnerability and cause the app to delete all or selected records from the database, rendering the app unusable. This vulnerability can be triggered in apps that do not properly validate record IDs and use Watermelon Sync or the low-level database.adapter.destroyDeletedRecords method. While the integrity risk is low as maliciously deleted records won't synchronize, some local changes may be lost if the sync process fails. It is not possible to breach confidentiality or perform full exploitation of SQL Injection due to the limitations of SQLite. However, if an app relies on the absence of a record for security decisions, selective record deletion could lead to insecure behavior.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.15.10.15.1npm install @nozbe/watermelondb@0.15.1 -
>= 0.16.0, < 0.16.20.16.2npm install @nozbe/watermelondb@0.16.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the patched versions is not immediately feasible, there are two workarounds available:
-
Ensure that your backend service sanitizes record IDs sent in the
pull syncendpoint, allowing only IDs matching the pattern^[a-zA-Z0-9_-.]+$to be returned. -
If you directly use the
destroyDeletedRecordsmethod, validate all IDs passed using the same pattern mentioned above.
Conclusion
The vulnerability in WatermelonDB allows for a DoS attack using malicious record IDs. It is recommended to update to the patched versions or apply the provided workarounds to mitigate the vulnerability. For further assistance with vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for @nozbe/watermelondb →
FAQ
WatermelonDB is a JavaScript library for managing an in-memory database in React Native applications. It provides a simple and efficient way to store and retrieve data locally.
The vulnerability allows for a DoS attack by deleting records from the database. This can render the app unusable, but the deleted records won't synchronize. However, some local changes may be lost if the sync process fails.
No, there is no known way to breach confidentiality using this vulnerability. The limitations of SQLite prevent full exploitation of SQL Injection, and selectively deleted records will not be synchronized.
The patched versions of WatermelonDB are 0.15.1, 0.16.2, and 0.16.1-fix. Updating to these versions will mitigate the vulnerability.
Yes, if updating to the patched versions is not immediately feasible, you can sanitize record IDs in the backend service or validate IDs passed to the destroyDeletedRecords method.
