Electric
Monthly
Authenticated SQL injection in ElectricSQL's Electric Postgres sync engine (1.1.12 up to before 1.5.0) lets any authenticated user of the /v1/shape API smuggle arbitrary SQL through the order_by parameter. Because the shape layer forwarded the user-supplied ORDER BY string into a query with only permissive validation, crafted ORDER BY expressions (subqueries, casts, function calls) achieve error-based injection with full read, write, and destroy access to the backing PostgreSQL database. No public exploit identified at time of analysis and EPSS is very low (0.03%), but the fix (1.5.0) and PR diff are public.
Authenticated SQL injection in ElectricSQL's Electric Postgres sync engine (1.1.12 up to before 1.5.0) lets any authenticated user of the /v1/shape API smuggle arbitrary SQL through the order_by parameter. Because the shape layer forwarded the user-supplied ORDER BY string into a query with only permissive validation, crafted ORDER BY expressions (subqueries, casts, function calls) achieve error-based injection with full read, write, and destroy access to the backing PostgreSQL database. No public exploit identified at time of analysis and EPSS is very low (0.03%), but the fix (1.5.0) and PR diff are public.