Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-25852

CVE-2022-25852: pg-native and libpq vulnerable to uncontrolled resource consumption

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-25852
GHSA ID
GHSA-j32j-2hxv-rqf7
EPSS Score
0.60594%
CWE
CWE-400
Published
6/18/2022
Updated
10/19/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
libpqnpm<= 1.8.91.8.10
pg-nativenpm<= 3.0.03.0.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The security patches add array validation checks to multiple query execution methods in index.js. The vulnerable versions lacked these checks, allowing non-array parameters to trigger failed casting attempts. The added assertions in execParams, execPrepared, sendQueryParams, and sendQueryPrepared directly correlate to the CWE-400/CWE-704 vulnerabilities described. Test cases in async-socket.js and sync-parameters.js verify that non-array parameters now throw errors, confirming these were the entry points for the vulnerability. These functions would appear in runtime profiles when handling malicious parameter inputs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

p*-n*tiv* ***or* *.*.* *n* li*pq ***or* *.*.** *r* vuln*r**l* to **ni*l o* S*rvi** (*oS) w**n t** ***ons *tt*mpt to **st t** s**on* *r*um*nt to *n *rr*y *n* **il. T*is **pp*ns *or *v*ry non-*rr*y *r*um*nt p*ss**. **Not*:** p*-n*tiv* is * m*r* *in*in*

Reasoning

T** s**urity p*t***s *** *rr*y `v*li**tion` ****ks to multipl* qu*ry *x**ution m*t*o*s in `in**x.js`. T** vuln*r**l* v*rsions l**k** t**s* ****ks, *llowin* non-*rr*y p*r*m*t*rs to tri***r **il** **stin* *tt*mpts. T** ***** *ss*rtions in `*x**P*r*ms`,