Compliance Impact

This vulnerability allows attackers to read and modify JSON sub-fields beyond the intended scope, potentially exposing sensitive data such as tokens, Social Security Numbers (SSNs), or admin flags.

Such unauthorized access and modification of sensitive personal or protected health information can lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which mandate strict controls over access to and integrity of sensitive data.

Therefore, exploitation of this vulnerability could result in violations of these regulations due to improper data exposure and unauthorized data changes.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects Kysely, a type-safe TypeScript SQL query builder, in versions from 0.26.0 to 0.28.16. The issue lies in the DefaultQueryCompiler.visitJSONPathLeg function, which does not escape JSON-path metacharacters such as ., [, ], *, **, and ?. When attacker-controlled input is passed into certain functions like eb.ref(col, '->$').key(input) or .at(input), each dot in the input is treated as a path-leg separator. This allows an attacker to traverse from the intended JSON key into sibling and child fields that the developer did not intend to expose.

As a result, the attacker can gain read access, and in update statements, write access to JSON sub-fields outside the intended scope across databases like MySQL, PostgreSQL, and SQLite. This vulnerability was fixed in version 0.28.17.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to access and potentially modify JSON data fields that were not meant to be accessible. Specifically, the attacker can read sensitive data from sibling or child JSON fields beyond the intended key, and in some cases, write or update those fields.

Such unauthorized access and modification can lead to data leakage, data integrity issues, and potential compromise of application logic or user data stored in JSON columns within supported databases like MySQL, PostgreSQL, and SQLite.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Kysely to version 0.28.17 or later where the issue is fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for usage of the Kysely SQL query builder versions 0.26.0 to 0.28.16 in your environment, especially where JSON-path methods `.key()` or `.at()` are used with attacker-controlled input.

Detection involves identifying queries or logs where JSON-path metacharacters such as dots (.), brackets ([ ]), asterisks (*), double asterisks (**), or question marks (?) appear in inputs to `.key()` or `.at()` methods, which could indicate attempted path traversal.

Since this is a code-level vulnerability, network detection might include searching for suspicious payloads in application logs or network traffic that contain JSON-path metacharacters used in these methods.

Suggested commands to detect potential exploitation attempts could include grepping application logs or source code for vulnerable method usage patterns, for example:

• grep -rE '\.key\(|\.at\(' /path/to/source/code
• grep -rE '[\.\[\]\*\?]' /path/to/application/logs

Additionally, monitoring database query logs for JSON-path expressions containing unexpected metacharacters in keys may help detect exploitation attempts.

Useful 0 Not Useful 0