Privilege Escalation Vulnerability in AWS Advanced NodeJS Wrapper for Aurora PostgreSQL
Summary
GHSA-8wj8-cfxr-9374: AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance. Affects aws-advanced-nodejs-wrapper versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The AWS Advanced NodeJS Wrapper is a library designed to facilitate interactions with Amazon Aurora PostgreSQL databases. It provides developers with an easy-to-use interface for executing database operations while managing connections and handling errors. However, this package has a critical vulnerability that allows low-privileged authenticated users to escalate their privileges to the rds_superuser role, potentially compromising the security of the database and its data.
Vulnerability Detail
The vulnerability arises from a flaw in the AWS Wrappers for Amazon Aurora PostgreSQL, where a low-privileged authenticated user can craft a function that executes with the permissions of other Amazon RDS users. This could lead to unauthorized access to sensitive data or the ability to perform administrative tasks, posing significant risks to the integrity and confidentiality of the database. The vulnerability is classified under CWE-470, indicating a potential elevation of privilege.
How To Fix
Minimum fixed version
2.0.1
This is the first release that contains the fix.
npm install aws-advanced-nodejs-wrapper@2.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the permissions of low-privileged users to prevent them from creating functions that could exploit this vulnerability. However, the best solution is to upgrade to the latest version of the package.
Conclusion
In summary, the AWS Advanced NodeJS Wrapper has a critical vulnerability that allows privilege escalation for low-privileged authenticated users. It is essential to upgrade to version 2.0.1 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in your applications.
See every vulnerability recorded for aws-advanced-nodejs-wrapper →
FAQ
It is a privilege escalation vulnerability that allows low-privileged users to gain elevated permissions in the database.
You can check your application's package-lock.json file using Vulert, which monitors and alerts for open-source vulnerabilities in real-time.
If exploited, this vulnerability could allow unauthorized access to sensitive data and the ability to perform administrative tasks on the database.
Yes, you can restrict the permissions of low-privileged users as a temporary workaround until you can upgrade.
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
