Doctrine/ORM Regression in Query Parenthesis can have Security Implications
Summary
GHSA-vjrg-wpm8-rhrw: doctrine/orm Regression in Query Parenthesis can have Security Implications. Affects doctrine/orm versions >= 2.8.3, < 2.8.4. Fixed in 2.8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Doctrine/ORM is a popular Object-Relational Mapping (ORM) library for PHP. It provides a convenient way to interact with databases by mapping database tables to PHP objects. The library offers various features for querying and manipulating data, including the ability to construct complex queries using a fluent API. However, a recent regression in the library has introduced a vulnerability related to the handling of query parentheses.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of case-insensitive checks in the Where-Clause of a query. Statements in the Where-Clause were not properly wrapped in brackets, which can lead to unexpected behavior and potential security implications. An attacker could exploit this vulnerability to manipulate the query logic and potentially bypass security measures or gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
2.8.4
This is the first release that contains the fix.
composer require doctrine/orm:2.8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually adding brackets to the affected queries in the Where-Clause. Here's an example of how to modify a query to mitigate the vulnerability:
Before:
$queryBuilder->where('column = value');
After:
$queryBuilder->where('(column = value)');
By enclosing the statement in parentheses, the vulnerability can be mitigated.
Conclusion
In conclusion, the doctrine/orm package is affected by a regression vulnerability that can have security implications. It is crucial to upgrade to version 2.8.4 or later to mitigate the risk. If you require further assistance or support in resolving this vulnerability, please contact DevNack.com.
See every vulnerability recorded for doctrine/orm →
FAQ
Doctrine/ORM is an Object-Relational Mapping (ORM) library for PHP that provides a convenient way to interact with databases by mapping database tables to PHP objects.
The vulnerability can allow an attacker to manipulate query logic and potentially bypass security measures or gain unauthorized access to sensitive data.
To fix this vulnerability, it is recommended to upgrade to version 2.8.4 or later of the doctrine/orm package.
Yes, a temporary workaround is to manually add brackets to the affected queries in the Where-Clause.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-vjrg-wpm8-rhrw/GHSA-vjrg-wpm8-rhrw.json
References
Related vulnerabilities
Recent vulnerabilities recorded for doctrine/orm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
