CVE-2022-33171

Deeper analysis

The vulnerability is a SQL injection flaw (CWE-89) in the findOne function of TypeORM versions before 0.3.0. The function accepts either a string identifier or a FindOneOptions object; when an application passes a user-controlled parsed JSON object directly to the function, an attacker can supply a malicious FindOneOptions value instead of a simple ID string, causing the ORM to construct and execute attacker-controlled SQL.

An unauthenticated remote attacker can exploit the issue over the network by submitting crafted JSON input to any application endpoint that forwards such data into findOne without additional sanitization. Successful exploitation yields full read/write access to the underlying database, enabling data exfiltration, modification, or deletion and producing the maximum CVSS 3.1 score of 9.8.

Public disclosures on Seclists and Packet Storm reference information-disclosure PoCs against TypeORM 0.3.7 and note the upstream change between 0.2.45 and 0.3.0; the project maintainers state that input validation remains the calling application’s responsibility. The associated EPSS score has remained low, reaching a peak of only 0.0599.