SQL Injection Vulnerability in node-mysql

Background

The node-mysql package is a popular Node.js module used for interacting with MySQL databases. It provides a convenient API for executing SQL queries and managing database connections. However, versions up to 2.0.0-alpha7 of the package suffer from a SQL injection vulnerability. This vulnerability arises from the failure to properly escape keys of objects, which can lead to malicious SQL queries being executed.

Vulnerability Detail

The SQL injection vulnerability in node-mysql (CVE-2015-9244) allows an attacker to inject malicious SQL code into queries executed by the application. By manipulating the keys of objects passed to the mysql module, an attacker can craft SQL queries that can bypass input validation and execute arbitrary SQL commands. This can result in unauthorized data access, data manipulation, or even the complete compromise of the database server.

sudo apt-get install --only-upgrade node-mysql

Workaround

If upgrading to the fixed version is not immediately feasible, a temporary workaround can be implemented by manually escaping the keys before passing them to the mysql module. This can be done using a function similar to mysql.escape(), which properly escapes the keys to prevent SQL injection. Here's an example of how the workaround can be implemented in JavaScript:

const mysql = require('mysql');

function escapeKeys(obj) {
  const escapedObj = {};
  for (const key in obj) {
    if (obj.hasOwnProperty(key)) {
      escapedObj[mysql.escapeId(key)] = obj[key];
    }
  }
  return escapedObj;
}

const query = `SELECT * FROM users WHERE ${mysql.escape(escapeKeys(userInput))}`;

Conclusion

The SQL injection vulnerability in node-mysql (CVE-2015-9244) poses a significant risk to applications using vulnerable versions of the package. It is crucial to promptly upgrade to the fixed version (2.0.0-alpha8-1 or later) or implement the provided workaround to mitigate the risk of SQL injection attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for node-mysql →

FAQ