Compliance Impact

The vulnerability allows any authenticated user to perform error-based SQL injection via the order_by parameter, enabling them to read, write, and destroy the full contents of the underlying PostgreSQL database.

Such unauthorized access and manipulation of sensitive data can lead to violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls to ensure confidentiality, integrity, and availability of personal and health information.

Therefore, this vulnerability poses a significant risk to compliance with these regulations due to potential data breaches and loss of data integrity.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Electric, a Postgres sync engine, specifically in versions from 1.1.12 to before 1.5.0. The issue is with the order_by parameter in the ElectricSQL /v1/shape API, which is susceptible to error-based SQL injection. This means that an authenticated user can craft malicious ORDER BY expressions that exploit this flaw.

Through this vulnerability, an attacker can read, write, and destroy the entire contents of the underlying PostgreSQL database.

The vulnerability was fixed in version 1.5.0.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows any authenticated user to perform unauthorized actions on the database, including reading sensitive data, modifying data, and deleting data.

Such actions can lead to data breaches, loss of data integrity, and availability issues, severely impacting the security and reliability of your system.

Given the high CVSS score of 9.9, the impact is critical.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ElectricSQL to version 1.5.0 or later, where the issue with the order_by parameter in the /v1/shape API has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the SQL injection flaw in the `/v1/shape` API's `order_by` parameter with crafted payloads that trigger error-based SQL injection responses.

A common detection method is to send a POST request to the shape subscription endpoint with an `order_by` parameter containing a payload such as `CAST((SELECT version()) AS int) DESC`. If the system is vulnerable, the response will be a 500 error containing the PostgreSQL version string in the error message.

Example command using curl to test for the vulnerability:

• curl -X POST https://your-electricsql-server/v1/shape -H 'Content-Type: application/json' -d '{"order_by": "CAST((SELECT version()) AS int) DESC"}'

If the response contains database error messages revealing internal information (such as the PostgreSQL version), this indicates the presence of the vulnerability.

Note that this requires authentication since the vulnerability affects authenticated users.

Useful 0 Not Useful 0